GHSA-6rpq-6vv2-5222
Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference
Quick fix
GHSA-6rpq-6vv2-5222 — org.springframework.restdocs:spring-restdocs-webtestclient: upgrade to the fixed version with the command below.
# pom.xml: bump <version>4.0.1</version> for org.springframework.restdocs:spring-restdocs-webtestclientDetails
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next executed.
Affected versions: Spring REST Docs 4.0.0; 3.0.0 through 3.0.5; 2.0.0.RELEASE through 2.0.8.RELEASE.
Are you affected?
Enter the version of the package you're using.
Affected packages
4.0.0 Fixed in: 4.0.1 # pom.xml: bump <version>4.0.1</version> for org.springframework.restdocs:spring-restdocs-webtestclient 3.0.0 Fixed in: 3.0.6 # pom.xml: bump <version>3.0.6</version> for org.springframework.restdocs:spring-restdocs-webtestclient 0 No fixed version published yet for org.springframework.restdocs:spring-restdocs-webtestclient (maven). Pin to a known-safe version or switch to an alternative.
4.0.0 Fixed in: 4.0.1 # pom.xml: bump <version>4.0.1</version> for org.springframework.restdocs:spring-restdocs-restassured 3.0.0 Fixed in: 3.0.6 # pom.xml: bump <version>3.0.6</version> for org.springframework.restdocs:spring-restdocs-restassured 0 No fixed version published yet for org.springframework.restdocs:spring-restdocs-restassured (maven). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-40991 [ADVISORY]
- https://github.com/spring-projects/spring-restdocs [PACKAGE]
- https://github.com/spring-projects/spring-restdocs/releases/tag/v3.0.6 [WEB]
- https://github.com/spring-projects/spring-restdocs/releases/tag/v4.0.1 [WEB]
- https://spring.io/security/cve-2026-40991 [WEB]