Spring Web Services versions 3.1.0 to 3.1.8, 4.0.0 to 4.0.18, 4.1.0 to 4.1.3, and 5.0.0 to 5.0.1 contain a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) identified as CVE-2026-40999. When WS-Addressing is configured with non-anonymous ReplyTo or FaultTo addresses, the framework may initiate outbound connections using WebServiceMessageSender instances to destinations derived directly from request headers without verifying their safety. This can allow an attacker to induce the server to make arbitrary HTTP requests to internal or external systems. The CVSS v3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, scope changed, and high confidentiality impact. No official remediation or patch information is currently provided.

Successful exploitation allows an unauthenticated attacker to cause the affected Spring Web Services server to make arbitrary outbound HTTP requests to attacker-controlled or internal destinations. This can lead to unauthorized information disclosure from internal systems or services accessible only from the server, impacting confidentiality. There is no direct impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling WS-Addressing features that use non-anonymous ReplyTo or FaultTo addresses or implement network-level controls to restrict outbound connections from the affected service. Monitor vendor communications for updates on patches or official mitigations.