CVE-2026-40998: Jaxp13 XPath XXE via StreamSource and SAXSource

Synopsis

XML External Entity (XXE) injection in Spring Web Services allows a remote, unauthenticated attacker to exploit the Jaxp13XPathTemplate class when it processes StreamSource or SAXSource inputs. The vulnerable code path parses attacker-controlled XML using the JDK's default DocumentBuilderFactory instead of Spring's hardened parser configuration, exposing external entity resolution over the network. Successful exploitation reads files and internal resources accessible to the application process, and allows limited data tampering via side-channel writes. Patched-image rebuilds at versions 3.1.9, 4.0.19, 4.1.4, and 5.0.2 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable Spring Web Services endpoint over the network to submit a crafted XML payload.

• AuthenticationNot required

  No credentials or account are needed; the vulnerable endpoint can be reached anonymously.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required to trigger external entity resolution.

Blast Radius

• A successful attacker reads arbitrary files on the server filesystem that the application process has permission to open, including configuration files, credentials, and private keys.
• The attacker can trigger outbound HTTP or DNS requests from the server to internal network resources, effectively using the application as a proxy to probe internal infrastructure.
• CVSS integrity impact is rated Low, meaning the attacker can induce limited out-of-band data writes or server-side request forgery interactions, but cannot directly overwrite application data.
• Availability is not impacted; the service remains running and there is no crash or denial-of-service primitive exposed by this vulnerability.