Description

Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData, contradicting the intended secure default and published setter contract. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules around signatures and related constructs, weakening protocol-level checks that are meant to constrain interoperable, safe use of WS-Security.

Preconditions include use of Wss4jSecurityInterceptor (or equivalent wiring) for inbound validation without explicitly enabling BSP compliance.

Affected Spring Products and Versions

Spring Web Services:

• 5.0.0 - 5.0.1
• 4.1.0 - 4.1.3
• 4.0.0 - 4.0.18
• 3.1.0 - 3.1.8

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

If you are not able to upgrade, you can enable BSP compliance explicitly by calling the setBspCompliant setter method with true as argument.

References

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N&version=3.1

History

• 2026-06-10: Initial vulnerability report published.