Spring Security Advisories

CVE-2026-40991: XML External Entity (XXE) injection when documenting untrusted XML content

MEDIUM | JUNE 09, 2026 | CVE-2026-40991

Description

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.

Affected Spring Products and Versions

Spring REST Docs:

4.0.0
3.0.0 - 3.0.5
2.0.0.RELEASE - 2.0.8.RELEASE

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)	Fix version	Availability
4.0.x	4.0.1	OSS
4.0.x	4.0.0.1	Enterprise Support Only
3.0.x	3.0.6	OSS
3.0.x	3.0.5.1	Enterprise Support Only
2.0.x	2.0.9.RELEASE	Enterprise Support Only

No further mitigation steps are necessary.

References

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L&version=3.1

History

2026-06-09: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy