CVE-2026-40991
MEDIUM EPSS 12.7%
Published Jun 10, 20263w ago · Modified Jun 17, 20262w ago
5.9 CVSS 3.1
Published Jun 10, 2026 3w ago
Last Modified Jun 17, 2026 2w ago
Description
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed. Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity None
Availability Low
Threat Intelligence
EPSS Exploit Probability
12.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-611
References 1
- spring.io https://spring.io/security/cve-2026-40991
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.