CVE-2026-40991

MEDIUM

XML External Entity (XXE) injection when documenting untrusted XML content

Title source: cna

Description

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed. Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.

References (1)

Core 1

Core References

https://spring.io/security/cve-2026-40991

Scores

CVSS v3 5.9

EPSS 0.0022

EPSS Percentile 12.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-611

Status published

Products (3)

Spring/Spring REST Docs 2.0.0.RELEASE - 2.0.9.RELEASE

Spring/Spring REST Docs 3.0.0 - 3.0.6

Spring/Spring REST Docs 4.0.0 - 4.0.1

Published Jun 10, 2026

Tracked Since Jun 10, 2026