Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

spring-projects/spring-ws

              main @ 998d5ed
            

Fixes

CVEs

HIGH

Peak severity

14.3%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

spring-ws-security: most-fixed (4 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Server-Side Request Forgery: Processing out-of-band WS-Addressing headers like wsa:ReplyTo or wsa:FaultTo can allow external peers to trigger Server-Side Request Forgery (SSRF) and DNS rebinding attacks if destination URIs are not strictly validated against a private IP and host allowlist.

Auth Bypass: Failing to bind message replay detection components (nonce, timestamp, and SAML one-time-use caches) into the incoming validation context allows attackers to replay intercepted WS-Security messages.

XXE: Evaluating XPath expressions over un-hardened XML Stream or SAX sources allows attackers to execute XML External Entity (XXE) injection attacks, leaking local files or internal resources.