Description

Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections against replay of UsernameToken nonces and creation timestamps, Timestamp elements, and certain SAML one-time-use semantics could be ineffective even when operators configured a replay cache on the interceptor, allowing attackers to re-submit still-valid cryptographic material within the acceptance window.

Preconditions include validation of constructs that rely on replay detection, a service that accepts repeated SOAP messages over the network, and configurations that expect WSS4J replay caches to be enforced.

Affected Spring Products and Versions

Spring Web Services:

• 5.0.0 - 5.0.1
• 4.1.0 - 4.1.3
• 4.0.0 - 4.0.18
• 3.1.0 - 3.1.8

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

If you are not able to upgrade, you can enable a replay cache by extending Wss4jSecurityInterceptor and overriding initializeValidationRequestData(MessageContext messageContext):

protected RequestData initializeValidationRequestData(MessageContext messageContext) {
    RequestData requestData = super.initializeValidationRequestData(messageContext);
	// Create ReplayCache according to your deployment scenario
	requestData.setNonceReplayCache(replayCache);
	requestData.setTimestampReplayCache(replayCache);
	requestData.setSamlOneTimeUseReplayCache(replayCache);
	return requestData;
}

References

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N&version=3.1

History

• 2026-06-10: Initial vulnerability report published.