Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks.
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
🚨*CVE*
CVE-2026-40998 Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default Doc… cve.org/CVERecord?id=CVE-202…
-----
Traducción:
CVE-2026-40998 Jax… infoflow.cloud`
CVE-2026-40998 Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default Doc… cve.org/CVERecord?id=CVE-202…
Oh no, this is illegal hackery 🫣 The _ methods are internal and you're not supposed to work with those. If you want to implement a custom source, simply use Mediabunny's StreamSource, which is made for exactly that! (It's just badly named)
And if you end up wanting to see more Christian Bale, go find a streamsource or library copy of Rescue Dawn. (One more tour-de-force from him.) @Blakenomics