What is GHSA-5x25-c2rf-f2jx?

GHSA-5x25-c2rf-f2jx is a security advisory published by GitHub Security Advisories with Medium severity. Several Spring WS integration paths with Spring Security could surface detailed account state ...

Which CVE IDs does GHSA-5x25-c2rf-f2jx cover?

GHSA-5x25-c2rf-f2jx covers the following CVE IDs: CVE-2026-40997. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5x25-c2rf-f2jx?

GHSA-5x25-c2rf-f2jx has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-5x25-c2rf-f2jxMediumCVSS 5.3

Several Spring WS integration paths with Spring Security could surface detailed account state ...

Vendor

GitHub Security Advisories

Published

June 11, 2026

Last Modified

June 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-40997 →

📋 Description

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state.

Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-40997
https://spring.io/security/cve-2026-40997
https://github.com/advisories/GHSA-5x25-c2rf-f2jx