Spring Framework (Spring) - vulnerabilities (CVEs)

45 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2026-08-27. Vendor: Spring.

CVEs of Spring Framework

• CVE-2026-59314 - CVSS 3.7 (low), 2026-08-27: Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious…
• CVE-2026-59313 - CVSS 9.8 (critical), 2026-08-27: Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 -…
• CVE-2026-59283 - CVSS 9.1 (critical), 2026-08-27: Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the…
• CVE-2026-59282 - CVSS 7.5 (high), 2026-08-27: Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a…
• CVE-2026-59281 - CVSS 6.1 (medium), 2026-08-27: Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument…
• CVE-2026-59280 - CVSS 4.3 (medium), 2026-08-27: Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from…
• CVE-2026-47893 - CVSS 7.5 (high), 2026-08-27: A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception…
• CVE-2026-47892 - CVSS 9.8 (critical), 2026-08-27: A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.…
• CVE-2026-47891 - CVSS 9.8 (critical), 2026-08-27: A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework…
• CVE-2026-47890 - CVSS 9.8 (critical), 2026-08-27: Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 -…
• CVE-2026-47889 - CVSS 7.5 (high), 2026-08-27: A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8…
• CVE-2026-47888 - CVSS 7.5 (high), 2026-08-27: A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring…
• CVE-2026-47887 - CVSS 6.1 (medium), 2026-08-27: A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an…
• CVE-2026-47886 - CVSS 7.5 (high), 2026-08-27: Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power…
• CVE-2026-47885 - CVSS 7.5 (high), 2026-08-27: The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8…
• CVE-2026-47883 - CVSS 6.1 (medium), 2026-08-27: UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both…
• CVE-2026-47884 - CVSS 9.8 (critical), 2026-08-27: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and…
• CVE-2026-41850 - CVSS 7.5 (high), 2026-06-09: Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing…
• CVE-2026-41853 - CVSS 5.3 (medium), 2026-06-09: Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0…
• CVE-2026-41849 - CVSS 7.5 (high), 2026-06-09: An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a…
• CVE-2026-41852 - CVSS 5.3 (medium), 2026-06-09: A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or…
• CVE-2026-41855 - CVSS 9.8 (critical), 2026-06-09: In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and…
• CVE-2026-41851 - CVSS 7.5 (high), 2026-06-09: Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation…
• CVE-2026-41854 - CVSS 6.5 (medium), 2026-06-09: Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a…
• CVE-2026-41847 - CVSS 5.3 (medium), 2026-06-09: Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.
• CVE-2026-41843 - CVSS 5.9 (medium), 2026-06-09: Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0…
• CVE-2026-41846 - CVSS 6.1 (medium), 2026-06-09: Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary…
• CVE-2026-41842 - CVSS 7.5 (high), 2026-06-09: Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Framework…
• CVE-2026-41845 - CVSS 7.1 (high), 2026-06-09: Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a…
• CVE-2026-41848 - CVSS 7.5 (high), 2026-06-09: Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or…
• CVE-2026-41841 - CVSS 5.9 (medium), 2026-06-09: Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework…
• CVE-2026-41844 - CVSS 6.1 (medium), 2026-06-09: A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a…
• CVE-2026-41840 - CVSS 5.9 (medium), 2026-06-09: Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0…
• CVE-2026-41839 - CVSS 4.2 (medium), 2026-06-09: A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging…
• CVE-2026-41838 - CVSS 7.5 (high), 2026-06-09: IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with…
• CVE-2026-22737 - CVSS 5.9 (medium), 2026-03-20: Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content…
• CVE-2025-22233 - CVSS 3.1 (low), 2025-05-16: CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However,…
• CVE-2024-38808 - CVSS 4.3 (medium), 2024-08-20: In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression…
• CVE-2024-22262 - CVSS 8.1 (high), 2024-04-16: Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of…
• CVE-2024-22259 - CVSS 8.1 (high), 2024-03-16: Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation…
• CVE-2024-22243 - CVSS 8.1 (high), 2024-02-23: Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of…
• CVE-2024-22233 - CVSS 7.5 (high), 2024-01-22: In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS)…
• CVE-2023-34053 - CVSS 7.5 (high), 2023-11-28: In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS)…
• CVE-2020-5397 - CVSS 5.3 (medium), 2020-01-17: Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module)…
• CVE-2020-5398 - CVSS 8 (high), 2020-01-17: In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a…