Spring - vulnerabilities (CVEs)

247 CVEs in 49 products, 0 in the last 30 days, newest from 2026-08-27.

Products

• Spring Framework - 45 CVEs
• Spring Security - 28 CVEs
• Spring Ai - 18 CVEs
• Spring Integration - 16 CVEs
• Spring Boot - 15 CVEs
• Spring Cloud Config - 9 CVEs
• Spring For Graphql - 9 CVEs
• Spring Amqp - 8 CVEs
• Spring Cloud Function - 8 CVEs
• Spring Web Services - 8 CVEs
• Reactor Netty - 7 CVEs
• Spring Data Rest - 6 CVEs
• Spring For Apache Kafka - 6 CVEs
• Spring Tools For Eclipse - 6 CVEs
• Spring Cloud Stream - 5 CVEs
• Micrometer - 4 CVEs
• Spring - 4 CVEs
• Spring Batch - 4 CVEs
• Spring Data Commons - 4 CVEs
• Spring Hateoas - 3 CVEs
• Reactor Core - 2 CVEs
• Spring Authorization Server - 2 CVEs
• Spring Cloud Gateway - 2 CVEs
• Spring Data Jpa - 2 CVEs
• Spring Data Mongodb - 2 CVEs
• Spring Grpc - 2 CVEs
• Spring Ldap - 2 CVEs
• Spring Security Oauth - 2 CVEs
• Spring Tools For Vscode Cursor Theia - 2 CVEs
• Spring Web Flow - 2 CVEs
• Cli Vscode Extension - 1 CVEs
• Cloud Gateway - 1 CVEs
• Micrometer Tracing - 1 CVEs
• Spring Cloud - 1 CVEs
• Spring Cloud Commons - 1 CVEs
• Spring Cloud Contract - 1 CVEs
• Spring Cloud Data Flow - 1 CVEs
• Spring Cloud Sleuth - 1 CVEs
• Spring Data Jdbc - 1 CVEs
• Spring Data Keyvalue - 1 CVEs
• Spring Data R2dbc - 1 CVEs
• Spring Data Redis - 1 CVEs
• Spring Data Relational - 1 CVEs
• Spring For Apache Pulsar - 1 CVEs
• Spring Foundation - 1 CVEs
• Spring Rest Docs - 1 CVEs
• Spring Retry - 1 CVEs
• Spring Statemachine - 1 CVEs
• Webflux - 1 CVEs

Newest CVEs of Spring

• CVE-2026-59324 - CVSS 8.2 (high), 2026-08-27: When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same…
• CVE-2026-59322 - CVSS 6.3 (medium), 2026-08-27: The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte…
• CVE-2026-59321 - CVSS 5.4 (medium), 2026-08-27: A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g.…
• CVE-2026-59320 - CVSS 6.5 (medium), 2026-08-27: When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one…
• CVE-2026-59317 - CVSS 6.5 (medium), 2026-08-27: DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new…
• CVE-2026-59319 - CVSS 4.3 (medium), 2026-08-27: RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying…
• CVE-2026-59316 - CVSS 8.2 (high), 2026-08-27: Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker…
• CVE-2026-59315 - CVSS 5.3 (medium), 2026-08-27: The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config…
• CVE-2026-59314 - CVSS 3.7 (low), 2026-08-27: Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious…
• CVE-2026-59311 - CVSS 6.8 (medium), 2026-08-27: A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating…
• CVE-2026-59306 - CVSS 3.8 (low), 2026-08-27: Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud…
• CVE-2026-59313 - CVSS 9.8 (critical), 2026-08-27: Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 -…
• CVE-2026-59307 - CVSS 8 (high), 2026-08-27: An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed…
• CVE-2026-59305 - CVSS 3.8 (low), 2026-08-27: Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream…
• CVE-2026-59304 - CVSS 3.8 (low), 2026-08-27: Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud…
• CVE-2026-59303 - CVSS 3.8 (low), 2026-08-27: Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud…
• CVE-2026-59302 - CVSS 4.9 (medium), 2026-08-27: Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 -…
• CVE-2026-59301 - CVSS 4.9 (medium), 2026-08-27: Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud…
• CVE-2026-59300 - CVSS 3.5 (low), 2026-08-27: Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud…
• CVE-2026-59299 - CVSS 3.5 (low), 2026-08-27: Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4…
• CVE-2026-59298 - CVSS 3.5 (low), 2026-08-27: Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring…
• CVE-2026-59297 - CVSS 3.5 (low), 2026-08-27: Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function…
• CVE-2026-59294 - CVSS 6.5 (medium), 2026-08-27: ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and…
• CVE-2026-59293 - CVSS 6.6 (medium), 2026-08-27: Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is…
• CVE-2026-59292 - CVSS 3.2 (low), 2026-08-27: PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to…
• CVE-2026-59291 - CVSS 5.5 (medium), 2026-08-27: Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring…
• CVE-2026-59289 - CVSS 7.5 (high), 2026-08-27: Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying…
• CVE-2026-59288 - CVSS 7.5 (high), 2026-08-27: The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that…
• CVE-2026-59287 - CVSS 5.9 (medium), 2026-08-27: Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring…
• CVE-2026-59286 - CVSS 8.1 (high), 2026-08-27: The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject…