org.springframework.ws:spring-xml
Maven2 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting org.springframework.ws:spring-xmlpage 1 of 1
- CVE-2019-3773CRITICALCVSS 9.8EG 9.8✓ Fixed in 3.0.62019-01-18
vulnerable: 3.0.0.RELEASE ... 3.0.5.RELEASE (6 versions)
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
- CVE-2026-40998HIGHCVSS 8.2EG 8.2✓ Fixed in 4.1.42026-06-11
vulnerable: 3.1.0 ... 3.1.8 (9 versions)
Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configur…
Check whether org.springframework.ws:spring-xml is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.springframework.ws:spring-xml CVEs against the assets you own.
Start Free Scan →