Spring Framework (Vmware) - vulnerabilities (CVEs)

86 CVEs, 0 in the last 30 days, 368 known versions, newest CVE from 2026-08-27. Vendor: Vmware.

CVEs of Spring Framework

• CVE-2026-59314 - CVSS 3.7 (low), 2026-08-27: Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious…
• CVE-2026-59313 - CVSS 9.8 (critical), 2026-08-27: Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 -…
• CVE-2026-59283 - CVSS 9.1 (critical), 2026-08-27: Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the…
• CVE-2026-59282 - CVSS 7.5 (high), 2026-08-27: Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a…
• CVE-2026-59281 - CVSS 6.1 (medium), 2026-08-27: Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument…
• CVE-2026-59280 - CVSS 4.3 (medium), 2026-08-27: Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from…
• CVE-2026-47893 - CVSS 7.5 (high), 2026-08-27: A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception…
• CVE-2026-47892 - CVSS 9.8 (critical), 2026-08-27: A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.…
• CVE-2026-47891 - CVSS 9.8 (critical), 2026-08-27: A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework…
• CVE-2026-47890 - CVSS 9.8 (critical), 2026-08-27: Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 -…
• CVE-2026-47889 - CVSS 7.5 (high), 2026-08-27: A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8…
• CVE-2026-47888 - CVSS 7.5 (high), 2026-08-27: A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring…
• CVE-2026-47887 - CVSS 6.1 (medium), 2026-08-27: A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an…
• CVE-2026-47886 - CVSS 7.5 (high), 2026-08-27: Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power…
• CVE-2026-47885 - CVSS 7.5 (high), 2026-08-27: The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8…
• CVE-2026-47883 - CVSS 6.1 (medium), 2026-08-27: UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both…
• CVE-2026-47884 - CVSS 9.8 (critical), 2026-08-27: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and…
• CVE-2026-41850 - CVSS 7.5 (high), 2026-06-09: Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing…
• CVE-2026-41853 - CVSS 5.3 (medium), 2026-06-09: Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0…
• CVE-2026-41849 - CVSS 7.5 (high), 2026-06-09: An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a…
• CVE-2026-41852 - CVSS 5.3 (medium), 2026-06-09: A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or…
• CVE-2026-41855 - CVSS 9.8 (critical), 2026-06-09: In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and…
• CVE-2026-41851 - CVSS 7.5 (high), 2026-06-09: Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation…
• CVE-2026-41854 - CVSS 6.5 (medium), 2026-06-09: Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a…
• CVE-2026-41843 - CVSS 5.9 (medium), 2026-06-09: Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0…
• CVE-2026-41846 - CVSS 6.1 (medium), 2026-06-09: Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary…
• CVE-2026-41842 - CVSS 7.5 (high), 2026-06-09: Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Framework…
• CVE-2026-41845 - CVSS 7.1 (high), 2026-06-09: Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a…
• CVE-2026-41848 - CVSS 7.5 (high), 2026-06-09: Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or…
• CVE-2026-41841 - CVSS 5.9 (medium), 2026-06-09: Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework…
• CVE-2026-41844 - CVSS 6.1 (medium), 2026-06-09: A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a…
• CVE-2026-41847 - CVSS 5.3 (medium), 2026-06-09: Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.
• CVE-2026-41840 - CVSS 5.9 (medium), 2026-06-09: Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0…
• CVE-2026-41839 - CVSS 4.2 (medium), 2026-06-09: A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging…
• CVE-2026-41838 - CVSS 7.5 (high), 2026-06-09: IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with…
• CVE-2026-22745 - CVSS 5.3 (medium), 2026-04-29: Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can be…
• CVE-2026-22741 - CVSS 3.1 (low), 2026-04-29: Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when…
• CVE-2026-22740 - CVSS 6.5 (medium), 2026-04-29: A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain…
• CVE-2026-22737 - CVSS 5.9 (medium), 2026-03-20: Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content…
• CVE-2026-22735 - CVSS 2.6 (low), 2026-03-20: Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0…
• CVE-2025-41254 - CVSS 4.3 (medium), 2025-10-16: STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and…
• CVE-2025-41249 - CVSS 7.5 (high), 2025-09-16: The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type…
• CVE-2025-41242 - CVSS 5.9 (medium), 2025-08-18: Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can…
• CVE-2025-41234 - CVSS 6.5 (medium), 2025-06-12: Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack…
• CVE-2024-38820 - CVSS 5.3 (medium), 2024-10-18: The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions…
• CVE-2024-38809 - CVSS 5.3 (medium), 2024-09-27: Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to…
• CVE-2024-38808 - CVSS 4.3 (medium), 2024-08-20: In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression…
• CVE-2024-22262 - CVSS 8.1 (high), 2024-04-16: Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of…
• CVE-2024-22259 - CVSS 8.1 (high), 2024-03-16: Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation…
• CVE-2024-22243 - CVSS 8.1 (high), 2024-02-23: Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of…
• CVE-2024-22233 - CVSS 7.5 (high), 2024-01-22: In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS)…
• CVE-2023-34053 - CVSS 7.5 (high), 2023-11-28: In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS)…
• CVE-2023-20863 - CVSS 6.5 (medium), 2023-04-13: In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may…
• CVE-2023-20860 - CVSS 7.5 (high), 2023-03-27: Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a…
• CVE-2023-20861 - CVSS 6.5 (medium), 2023-03-23: In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to…
• CVE-2022-22971 - CVSS 6.5 (medium), 2022-05-12: In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a…
• CVE-2022-22970 - CVSS 5.3 (medium), 2022-05-12: In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if…
• CVE-2022-22968 - CVSS 5.3 (medium), 2022-04-14: In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case…
• CVE-2022-22965 - CVSS 9.8 (critical), 2022-04-01: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires…
• CVE-2022-22950 - CVSS 6.5 (medium), 2022-04-01: n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may…
• CVE-2021-22060 - CVSS 4.3 (medium), 2022-01-10: In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the…
• CVE-2021-22096 - CVSS 4.3 (medium), 2021-10-28: In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the…
• CVE-2021-22118 - CVSS 7.8 (high), 2021-05-27: In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by…
• CVE-2020-5421 - CVSS 8.7 (high), 2020-09-19: In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD…
• CVE-2020-5397 - CVSS 5.3 (medium), 2020-01-17: Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module)…
• CVE-2020-5398 - CVSS 8 (high), 2020-01-17: In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a…
• CVE-2016-1000027 - CVSS 9.8 (critical), 2020-01-02: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data.…
• CVE-2018-15801 - CVSS 7.4 (high), 2018-12-19: Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same…
• CVE-2018-15756 - CVSS 7.5 (high), 2018-10-18: Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide…
• CVE-2018-11040 - CVSS 7.5 (high), 2018-06-25: Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain…
• CVE-2018-11039 - CVSS 5.9 (medium), 2018-06-25: Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP…
• CVE-2018-1258 - CVSS 8.8 (high), 2018-05-11: Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An…
• CVE-2018-1257 - CVSS 6.5 (medium), 2018-05-11: Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over…
• CVE-2018-1275 - CVSS 9.8 (critical), 2018-04-11: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over…
• CVE-2018-1272 - CVSS 7.5 (high), 2018-04-06: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart…
• CVE-2018-1271 - CVSS 5.9 (medium), 2018-04-06: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to…
• CVE-2018-1270 - CVSS 9.8 (critical), 2018-04-06: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over…
• CVE-2018-1199 - CVSS 5.3 (medium), 2018-03-16: Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before…
• CVE-2016-5007 - CVSS 7.5 (high), 2017-05-25: Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping…
• CVE-2015-5211 - CVSS 9.6 (critical), 2017-05-25: Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File…
• CVE-2014-0225 - CVSS 8.8 (high), 2017-05-25: When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by…
• CVE-2016-9878 - CVSS 7.5 (high), 2016-12-29: An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not…
• CVE-2015-3192 - CVSS 5.5 (medium), 2016-07-12: Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows…
• CVE-2015-0201 - CVSS 5 (medium), 2015-03-10: The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to…
• CVE-2014-3625 - CVSS 5 (medium), 2014-11-20: Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote…
• CVE-2014-0054 - CVSS 6.8 (medium), 2014-04-17: The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution,…
• CVE-2013-6429 - CVSS 6.8 (medium), 2014-01-26: The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution,…
• CVE-2013-7315 - CVSS 6.8 (medium), 2014-01-23: The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which…
• CVE-2013-4152 - CVSS 6.8 (medium), 2014-01-23: The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows…
• CVE-2011-2894 - CVSS 6.8 (medium), 2011-10-04: Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from…