Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.springframework.restdocs:spring-restdocs-restassured

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9MavenPublished

    Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

    CVE-2026-40991 · GHSA-6rpq-6vv2-5222

    Affected
    • Maven org.springframework.restdocs:spring-restdocs-restassured >= 4.0.0, <= 4.0.0; >= 3.0.0, <= 3.0.5; <= 2.0.8.RELEASE
    Fixed in
    3.0.64.0.1· Partial vendor fix
    Issue
    When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed. Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.

    Recommended action: Upgrade to 4.0.1 or 3.0.6 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →