CVE-2026-40999 is a high-severity SSRF vulnerability in Spring Web Services. When WS-Addressing is configured with non-anonymous ReplyTo or FaultTo addresses, the framework may make outbound connections through WebServiceMessageSender instances to endpoints directly derived from request headers. These destinations are not validated for safety, potentially allowing an attacker to cause the server to connect to arbitrary internal or external systems. The affected versions include Spring Web Services 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1. No vendor advisory or patch information is provided in the data, and no known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated attacker to induce the vulnerable Spring Web Services instance to make network requests to arbitrary destinations. This can lead to information disclosure or interaction with internal systems that are otherwise inaccessible, impacting confidentiality. The CVSS score is 8.6 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a confidentiality impact only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, carefully review and restrict the use of WS-Addressing with non-anonymous ReplyTo or FaultTo addresses. Avoid accepting untrusted input for these headers or implement strict validation of outbound destinations in WebServiceMessageSender configurations.