CVE-2026-40997
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
Jun 11, 2026
CISA due date
—
The record
Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-92936 vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code… CWE-209
- CVE-2026-11873 An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests)… CWE-209
- CVE-2026-82739 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
- CVE-2026-82733 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
- CVE-2026-77950 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
- CVE-2026-82727 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
- CVE-2026-82580 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209
- CVE-2026-75760 Generation of Error Message Containing Sensitive Information vulnerability in ash-project… CWE-209