Search

Find a vulnerability

Search criteria

    3 vulnerabilities found for Spring REST Docs by Spring

    CVE-2026-40991 (GCVE-0-2026-40991)

    Vulnerability from nvd – Published: 2026-06-09 23:46 – Updated: 2026-06-27 21:10
    VLAI
    Title
    XML External Entity (XXE) injection when documenting untrusted XML content
    Summary
    When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed. Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.
    Severity
    5.9 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-611 - Improper Restriction of XML External Entity Reference
    Assigner
    References
    Impacted products
    Vendor Product Version
    Spring Spring REST Docs Affected: 4.0.0 , < 4.0.0.1 (custom)
    Affected: 3.0.0 , < 3.0.5.1 (custom)
    Affected: 2.0.0.RELEASE , < 2.0.9.RELEASE (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T13:01:26.403312Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T13:01:36.180Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring REST Docs",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.5.1",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.9.RELEASE",
              "status": "affected",
              "version": "2.0.0.RELEASE",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.\n\nAffected versions:\nSpring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE."
            }
          ],
          "value": "When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.\n\nAffected versions:\nSpring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can compromise or impersonate a remote API can perform an XXE injection attack when spring-restdocs documentation tests execute against the malicious endpoint."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-27T21:10:14.865Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-40991"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "XML External Entity (XXE) injection when documenting untrusted XML content",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-40991",
    "datePublished": "2026-06-09T23:46:33.676Z",
    "dateReserved": "2026-04-16T02:19:09.389Z",
    "dateUpdated": "2026-06-27T21:10:14.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-40991 (GCVE-0-2026-40991)

    Vulnerability from cvelistv5 – Published: 2026-06-09 23:46 – Updated: 2026-06-27 21:10
    VLAI
    Title
    XML External Entity (XXE) injection when documenting untrusted XML content
    Summary
    When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed. Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.
    Severity
    5.9 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-611 - Improper Restriction of XML External Entity Reference
    Assigner
    References
    Impacted products
    Vendor Product Version
    Spring Spring REST Docs Affected: 4.0.0 , < 4.0.0.1 (custom)
    Affected: 3.0.0 , < 3.0.5.1 (custom)
    Affected: 2.0.0.RELEASE , < 2.0.9.RELEASE (custom)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T13:01:26.403312Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T13:01:36.180Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring REST Docs",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "4.0.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.5.1",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.9.RELEASE",
              "status": "affected",
              "version": "2.0.0.RELEASE",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.\n\nAffected versions:\nSpring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE."
            }
          ],
          "value": "When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.\n\nAffected versions:\nSpring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker who can compromise or impersonate a remote API can perform an XXE injection attack when spring-restdocs documentation tests execute against the malicious endpoint."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-27T21:10:14.865Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-40991"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "XML External Entity (XXE) injection when documenting untrusted XML content",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-40991",
    "datePublished": "2026-06-09T23:46:33.676Z",
    "dateReserved": "2026-04-16T02:19:09.389Z",
    "dateUpdated": "2026-06-27T21:10:14.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CERTFR-2026-AVI-0705

    Vulnerability from certfr_avis - Published: 2026-06-09 - Updated: 2026-06-09

    De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Spring Spring Retry Retry versions 1.3.x antérieures à 1.3.5
    Spring Reactor Netty Reactor Netty versions 1.0.x antérieures à 1.0.52 (Reactor BOM 2020.0.51)
    Spring Spring REST Docs REST Docs versions 2.0.x antérieures à 2.0.9
    Spring Spring REST Docs REST Docs versions 3.0.x antérieures à 3.0.6 (source ouverte) ou 3.0.5.1 (licence commerciale)
    Spring Reactor Netty Reactor Netty versions 1.3.x antérieures à 1.3.6 (Reactor BOM 2025.0.6)
    Spring Spring Retry Retry versions 2.0.x antérieures à 2.0.13
    Spring Spring LDAP LDAP versions 3.2.x antérieures à 3.2.18
    Spring Spring Framework Framework versions 6.2.x antérieures à 6.2.19 (source ouverte) ou 6.2.18.1 (licence commerciale)
    Spring Reactor Netty Reactor Netty versions 1.1.x antérieures à 1.1.36 (Reactor BOM 2023.0.24)
    Spring Spring Framework Framework versions 7.0.x antérieures à 7.0.8 (source ouverte) ou 7.0.7.1 (licence commerciale)
    Spring Spring LDAP LDAP versions 2.4.x antérieures à 2.4.5
    Spring Spring LDAP LDAP versions 3.3.x antérieures à 3.3.8
    Spring Spring REST Docs REST Docs versions 4.0.x antérieures à 4.0.1 (source ouverte) ou 4.0.0.1 (licence commerciale)
    Spring Spring LDAP LDAP versions 4.0.x antérieures à 4.0.4
    Spring Reactor Netty Reactor Netty versions 1.2.x antérieures à 1.2.18 (Reactor BOM 2024.0.18)
    Spring Spring Framework Framework versions 6.1.x antérieures à 6.1.28
    Spring Spring Framework Framework versions 5.3.x antérieures à 5.3.49
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Retry versions 1.3.x ant\u00e9rieures \u00e0 1.3.5",
      "product": {
        "name": "Spring Retry",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Reactor Netty versions 1.0.x ant\u00e9rieures \u00e0 1.0.52 (Reactor BOM 2020.0.51)",
      "product": {
        "name": "Reactor Netty",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "REST Docs versions 2.0.x ant\u00e9rieures \u00e0 2.0.9",
      "product": {
        "name": "Spring REST Docs",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "REST Docs versions 3.0.x ant\u00e9rieures \u00e0 3.0.6 (source ouverte) ou 3.0.5.1 (licence commerciale)",
      "product": {
        "name": "Spring REST Docs",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Reactor Netty versions 1.3.x ant\u00e9rieures \u00e0 1.3.6 (Reactor BOM 2025.0.6)",
      "product": {
        "name": "Reactor Netty",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Retry versions 2.0.x ant\u00e9rieures \u00e0 2.0.13",
      "product": {
        "name": "Spring Retry",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "LDAP versions 3.2.x ant\u00e9rieures \u00e0 3.2.18",
      "product": {
        "name": "Spring LDAP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 6.2.x ant\u00e9rieures \u00e0 6.2.19 (source ouverte) ou 6.2.18.1 (licence commerciale)",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Reactor Netty versions 1.1.x ant\u00e9rieures \u00e0 1.1.36 (Reactor BOM 2023.0.24)",
      "product": {
        "name": "Reactor Netty",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 7.0.x ant\u00e9rieures \u00e0 7.0.8 (source ouverte) ou 7.0.7.1 (licence commerciale)",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "LDAP versions 2.4.x ant\u00e9rieures \u00e0 2.4.5",
      "product": {
        "name": "Spring LDAP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "LDAP versions 3.3.x ant\u00e9rieures \u00e0 3.3.8",
      "product": {
        "name": "Spring LDAP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "REST Docs versions 4.0.x ant\u00e9rieures \u00e0 4.0.1 (source ouverte) ou 4.0.0.1 (licence commerciale)",
      "product": {
        "name": "Spring REST Docs",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "LDAP versions 4.0.x ant\u00e9rieures \u00e0 4.0.4",
      "product": {
        "name": "Spring LDAP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Reactor Netty versions 1.2.x ant\u00e9rieures \u00e0 1.2.18 (Reactor BOM 2024.0.18)",
      "product": {
        "name": "Reactor Netty",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 6.1.x ant\u00e9rieures \u00e0 6.1.28",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 5.3.x ant\u00e9rieures \u00e0 5.3.49",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-41710",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41710"
    },
    {
      "name": "CVE-2026-41839",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41839"
    },
    {
      "name": "CVE-2026-41844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41844"
    },
    {
      "name": "CVE-2026-41715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41715"
    },
    {
      "name": "CVE-2026-41842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41842"
    },
    {
      "name": "CVE-2026-40991",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40991"
    },
    {
      "name": "CVE-2026-41720",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41720"
    },
    {
      "name": "CVE-2026-41843",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41843"
    },
    {
      "name": "CVE-2026-41841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41841"
    },
    {
      "name": "CVE-2026-41838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41838"
    },
    {
      "name": "CVE-2026-41840",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41840"
    }
  ],
  "initial_release_date": "2026-06-09T00:00:00",
  "last_revision_date": "2026-06-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0705",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Spring. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Spring",
  "vendor_advisories": [
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41839",
      "url": "https://spring.io/security/cve-2026-41839"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40991",
      "url": "https://spring.io/security/cve-2026-40991/"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41710",
      "url": "https://spring.io/security/cve-2026-41710"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41844",
      "url": "https://spring.io/security/cve-2026-41844/"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41715",
      "url": "https://spring.io/security/cve-2026-41715"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41720",
      "url": "https://spring.io/security/cve-2026-41720"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41842",
      "url": "https://spring.io/security/cve-2026-41842"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41840",
      "url": "https://spring.io/security/cve-2026-41840"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41841",
      "url": "https://spring.io/security/cve-2026-41841"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41843",
      "url": "https://spring.io/security/cve-2026-41843/"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41838",
      "url": "https://spring.io/security/cve-2026-41838"
    }
  ]
}