Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreXML External Entity (XXE) injection when documenting untrusted XML content
Description
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document
a remote API accessed over HTTP, an attacker who compromises the API or tricks the user
into documenting a malicious API can perform an XXE injection attack when the
documentation-generating tests are next executed.
Affected Spring Products and Versions
Spring REST Docs:
- 4.0.0 - 4.0.0
- 3.0.0 - 3.0.5
- 2.0.8.RELEASE and earlier
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Fix version | Availability |
|---|---|
| 4.0.1 | OSS |
| 4.0.0.1 | Enterprise Support Only |
| 3.0.6 | OSS |
| 3.0.5.1 | Enterprise Support Only |
| 2.0.9.RELEASE | Enterprise Support Only |
No further mitigation steps are necessary.
History
- 2026-06-09: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all