Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

3 vulnerabilities found for Spring REST Docs by Spring

CVE-2026-40991 (GCVE-0-2026-40991)

Vulnerability from nvd – Published: 2026-06-09 23:46 – Updated: 2026-06-10 13:01
VLAI
Title
XML External Entity (XXE) injection when documenting untrusted XML content
Summary
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed. Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
Impacted products
Vendor Product Version
Spring Spring REST Docs Affected: 4.0.0 , < 4.0.1 (custom)
Affected: 3.0.0 , < 3.0.6 (custom)
Affected: 2.0.0.RELEASE , < 2.0.9.RELEASE (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T13:01:26.403312Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T13:01:36.180Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring REST Docs",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.6",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.9.RELEASE",
              "status": "affected",
              "version": "2.0.0.RELEASE",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.\n\nAffected versions:\nSpring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE."
            }
          ],
          "value": "When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.\n\nAffected versions:\nSpring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can compromise or impersonate a remote API can perform an XXE injection attack when spring-restdocs documentation tests execute against the malicious endpoint."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:46:33.676Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-40991"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "XML External Entity (XXE) injection when documenting untrusted XML content",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-40991",
    "datePublished": "2026-06-09T23:46:33.676Z",
    "dateReserved": "2026-04-16T02:19:09.389Z",
    "dateUpdated": "2026-06-10T13:01:36.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40991 (GCVE-0-2026-40991)

Vulnerability from cvelistv5 – Published: 2026-06-09 23:46 – Updated: 2026-06-10 13:01
VLAI
Title
XML External Entity (XXE) injection when documenting untrusted XML content
Summary
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed. Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
Impacted products
Vendor Product Version
Spring Spring REST Docs Affected: 4.0.0 , < 4.0.1 (custom)
Affected: 3.0.0 , < 3.0.6 (custom)
Affected: 2.0.0.RELEASE , < 2.0.9.RELEASE (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T13:01:26.403312Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T13:01:36.180Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring REST Docs",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.6",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.9.RELEASE",
              "status": "affected",
              "version": "2.0.0.RELEASE",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.\n\nAffected versions:\nSpring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE."
            }
          ],
          "value": "When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.\n\nAffected versions:\nSpring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can compromise or impersonate a remote API can perform an XXE injection attack when spring-restdocs documentation tests execute against the malicious endpoint."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:46:33.676Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-40991"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "XML External Entity (XXE) injection when documenting untrusted XML content",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-40991",
    "datePublished": "2026-06-09T23:46:33.676Z",
    "dateReserved": "2026-04-16T02:19:09.389Z",
    "dateUpdated": "2026-06-10T13:01:36.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CERTFR-2026-AVI-0705

Vulnerability from certfr_avis - Published: 2026-06-09 - Updated: 2026-06-09

De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Spring Spring Retry Retry versions 1.3.x antérieures à 1.3.5
Spring Reactor Netty Reactor Netty versions 1.0.x antérieures à 1.0.52 (Reactor BOM 2020.0.51)
Spring Spring REST Docs REST Docs versions 2.0.x antérieures à 2.0.9
Spring Spring REST Docs REST Docs versions 3.0.x antérieures à 3.0.6 (source ouverte) ou 3.0.5.1 (licence commerciale)
Spring Reactor Netty Reactor Netty versions 1.3.x antérieures à 1.3.6 (Reactor BOM 2025.0.6)
Spring Spring Retry Retry versions 2.0.x antérieures à 2.0.13
Spring Spring LDAP LDAP versions 3.2.x antérieures à 3.2.18
Spring Spring Framework Framework versions 6.2.x antérieures à 6.2.19 (source ouverte) ou 6.2.18.1 (licence commerciale)
Spring Reactor Netty Reactor Netty versions 1.1.x antérieures à 1.1.36 (Reactor BOM 2023.0.24)
Spring Spring Framework Framework versions 7.0.x antérieures à 7.0.8 (source ouverte) ou 7.0.7.1 (licence commerciale)
Spring Spring LDAP LDAP versions 2.4.x antérieures à 2.4.5
Spring Spring LDAP LDAP versions 3.3.x antérieures à 3.3.8
Spring Spring REST Docs REST Docs versions 4.0.x antérieures à 4.0.1 (source ouverte) ou 4.0.0.1 (licence commerciale)
Spring Spring LDAP LDAP versions 4.0.x antérieures à 4.0.4
Spring Reactor Netty Reactor Netty versions 1.2.x antérieures à 1.2.18 (Reactor BOM 2024.0.18)
Spring Spring Framework Framework versions 6.1.x antérieures à 6.1.28
Spring Spring Framework Framework versions 5.3.x antérieures à 5.3.49
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Retry versions 1.3.x ant\u00e9rieures \u00e0 1.3.5",
      "product": {
        "name": "Spring Retry",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Reactor Netty versions 1.0.x ant\u00e9rieures \u00e0 1.0.52 (Reactor BOM 2020.0.51)",
      "product": {
        "name": "Reactor Netty",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "REST Docs versions 2.0.x ant\u00e9rieures \u00e0 2.0.9",
      "product": {
        "name": "Spring REST Docs",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "REST Docs versions 3.0.x ant\u00e9rieures \u00e0 3.0.6 (source ouverte) ou 3.0.5.1 (licence commerciale)",
      "product": {
        "name": "Spring REST Docs",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Reactor Netty versions 1.3.x ant\u00e9rieures \u00e0 1.3.6 (Reactor BOM 2025.0.6)",
      "product": {
        "name": "Reactor Netty",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Retry versions 2.0.x ant\u00e9rieures \u00e0 2.0.13",
      "product": {
        "name": "Spring Retry",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "LDAP versions 3.2.x ant\u00e9rieures \u00e0 3.2.18",
      "product": {
        "name": "Spring LDAP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 6.2.x ant\u00e9rieures \u00e0 6.2.19 (source ouverte) ou 6.2.18.1 (licence commerciale)",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Reactor Netty versions 1.1.x ant\u00e9rieures \u00e0 1.1.36 (Reactor BOM 2023.0.24)",
      "product": {
        "name": "Reactor Netty",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 7.0.x ant\u00e9rieures \u00e0 7.0.8 (source ouverte) ou 7.0.7.1 (licence commerciale)",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "LDAP versions 2.4.x ant\u00e9rieures \u00e0 2.4.5",
      "product": {
        "name": "Spring LDAP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "LDAP versions 3.3.x ant\u00e9rieures \u00e0 3.3.8",
      "product": {
        "name": "Spring LDAP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "REST Docs versions 4.0.x ant\u00e9rieures \u00e0 4.0.1 (source ouverte) ou 4.0.0.1 (licence commerciale)",
      "product": {
        "name": "Spring REST Docs",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "LDAP versions 4.0.x ant\u00e9rieures \u00e0 4.0.4",
      "product": {
        "name": "Spring LDAP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Reactor Netty versions 1.2.x ant\u00e9rieures \u00e0 1.2.18 (Reactor BOM 2024.0.18)",
      "product": {
        "name": "Reactor Netty",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 6.1.x ant\u00e9rieures \u00e0 6.1.28",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 5.3.x ant\u00e9rieures \u00e0 5.3.49",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-41710",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41710"
    },
    {
      "name": "CVE-2026-41839",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41839"
    },
    {
      "name": "CVE-2026-41844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41844"
    },
    {
      "name": "CVE-2026-41715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41715"
    },
    {
      "name": "CVE-2026-41842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41842"
    },
    {
      "name": "CVE-2026-40991",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40991"
    },
    {
      "name": "CVE-2026-41720",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41720"
    },
    {
      "name": "CVE-2026-41843",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41843"
    },
    {
      "name": "CVE-2026-41841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41841"
    },
    {
      "name": "CVE-2026-41838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41838"
    },
    {
      "name": "CVE-2026-41840",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41840"
    }
  ],
  "initial_release_date": "2026-06-09T00:00:00",
  "last_revision_date": "2026-06-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0705",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Spring. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Spring",
  "vendor_advisories": [
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41839",
      "url": "https://spring.io/security/cve-2026-41839"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40991",
      "url": "https://spring.io/security/cve-2026-40991/"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41710",
      "url": "https://spring.io/security/cve-2026-41710"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41844",
      "url": "https://spring.io/security/cve-2026-41844/"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41715",
      "url": "https://spring.io/security/cve-2026-41715"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41720",
      "url": "https://spring.io/security/cve-2026-41720"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41842",
      "url": "https://spring.io/security/cve-2026-41842"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41840",
      "url": "https://spring.io/security/cve-2026-41840"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41841",
      "url": "https://spring.io/security/cve-2026-41841"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41843",
      "url": "https://spring.io/security/cve-2026-41843/"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41838",
      "url": "https://spring.io/security/cve-2026-41838"
    }
  ]
}