SecuriTricks - CVE-2026-40991

Description

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed. Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.

Product(s) Impacted

Vendor	Product	Versions
Spring	Spring Restdocs	4.0.0, 3.0.0-3.0.5, 2.0.0.RELEASE-2.0.8.RELEASE

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	spring	spring_restdocs	4.0.0	/	/	/	/	/	/	/
a	spring	spring_restdocs	3.0.0-3.0.5	/	/	/	/	/	/	/
a	spring	spring_restdocs	2.0.0.RELEASE-2.0.8.RELEASE	/	/	/	/	/	/	/

References

https://spring.io/security/cve-2026-40991

CVSS Score

5.9 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: NONE
Availability Impact: LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L

View Vector String

Timeline

Published: June 10, 2026, 12:16 a.m.
Last Modified: June 10, 2026, 7:24 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-40991