Medium severity5.9NVD Advisory· Published Jun 10, 2026· Updated Jun 10, 2026
CVE-2026-40991
CVE-2026-40991
Description
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.
Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework.restdocs:spring-restdocs-webtestclientMaven | >= 4.0.0, < 4.0.1 | 4.0.1 |
org.springframework.restdocs:spring-restdocs-webtestclientMaven | >= 3.0.0, < 3.0.6 | 3.0.6 |
org.springframework.restdocs:spring-restdocs-webtestclientMaven | <= 2.0.8.RELEASE | — |
org.springframework.restdocs:spring-restdocs-restassuredMaven | >= 4.0.0, < 4.0.1 | 4.0.1 |
org.springframework.restdocs:spring-restdocs-restassuredMaven | >= 3.0.0, < 3.0.6 | 3.0.6 |
org.springframework.restdocs:spring-restdocs-restassuredMaven | <= 2.0.8.RELEASE | — |
Affected products
3- Range: 4.0.0, 3.0.0 through 3.0.5, 2.0.0.RELEASE through 2.0.8.RELEASE
- ghsa-coords2 versionspkg:maven/org.springframework.restdocs/spring-restdocs-restassuredpkg:maven/org.springframework.restdocs/spring-restdocs-webtestclient
>= 4.0.0, < 4.0.1+ 1 more
- (no CPE)range: >= 4.0.0, < 4.0.1
- (no CPE)range: >= 4.0.0, < 4.0.1
Patches
Vulnerability mechanics
References
5News mentions
1- Spring Projects: 25 Vulnerabilities Disclosed, Including SpEL Injection and Deserialization FlawsVypr Intelligence · Jun 10, 2026