This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] VMware Spring fixes more than 60 vulnerabilities
As part of its June patches released so far, VMware Spring fixes 67 vulnerabilities in various products. The most severe of them are described below. The complete list of vulnerabilities, including fixed versions, can be found at [1] by expanding the individual advisories.
An unauthenticated remote attacker can carry out an SSRF attack due to insufficient validation of the ReplyTo/FaultTo headers in Spring Web Services. If updating is not possible, restrict the allowed targets for the individual configured sending components by overriding the supports method [2].
The vulnerability is present in product:
- Spring Web Services; >=5.0.0, <=5.0.1; >=4.1.0, <=4.1.3; >=4.0.0, <=4.0.18; >=3.1.0, <=3.1.8
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
More information:
- CVE-2026-40999 at cve.org, NVD
- CWE-918: Server-Side Request Forgery (SSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 10. 6. 2026.
An unauthenticated remote attacker can carry out an XXE attack, including possible disclosure of sensitive files, or carry out an SSRF attack due to the processing of untrusted XML using the default DocumentBuilderFactory configuration in Jaxp13XPathTemplate [3].
The vulnerability is present in product:
- Spring Web Services; >=5.0.0, <=5.0.1; >=4.1.0, <=4.1.3; >=4.0.0, <=4.0.18; >=3.1.0, <=3.1.8
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
More information:
- CVE-2026-40998 at cve.org, NVD
- CWE-611: Improper Restriction of XML External Entity Reference at cwe.mitre.org
The vulnerability was publicly disclosed 10. 6. 2026.
An unauthenticated remote attacker can use the JSON Patch specification in Spring Data REST to bypass read-only restrictions and modify nested objects or collections, because the system does not verify write permissions for intermediate path segments (JSON Pointer) [4].
The vulnerability is present in product:
- Spring Data REST; >=3.7.0, <=3.7.19; >=4.3.0, <=4.3.16; >=4.4.0, <=4.4.14; >=4.5.0, <=4.5.11; >=5.0.0, <=5.0.5
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
More information:
- CVE-2026-41728 at cve.org, NVD
- CWE-639: Authorization Bypass Through User-Controlled Key at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
An unauthenticated remote attacker can trigger deserialization of arbitrary gadget classes via vulnerable message converters in Spring JMS, leading to unauthorized actions. In untrusted JMS environments, update to a fixed version and restrict the packages allowed for deserialization using the setTrustedPackages(String... trustedPackages) methods [5]
The vulnerability is present in product:
- Spring Framework; >=7.0.0, <=7.0.7; >=6.2.0, <=6.2.18; >=6.1.0, <=6.1.27, >=5.3.0, <=5.3.48
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-41855 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 8. 6. 2026.
An unauthenticated remote attacker can execute arbitrary code due to unsafe deserialization when processing paginated GraphQL queries in Spring for GraphQL [6].
The vulnerability is present in product:
- Spring for GraphQL; >=2.0.0, <=2.0.3; >=1.4.0, <=1.4.5; >=1.3.0, <=1.3.8
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-41699 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 10. 6. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 11. 6. 2026.