Spring Spring Framework
28 CVEs affecting Spring Spring Framework. Latest disclosed: 2026-06-09. Critical: 0, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41855 | High | 8.1 | 2026-06-09 | In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.Jackso… |
CVE-2024-22262 | High | 8.1 | 2024-04-16 | Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of th… |
CVE-2024-22259 | High | 8.1 | 2024-03-16 | Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation chec… |
CVE-2024-22243 | High | 8.1 | 2024-02-23 | Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of th… |
CVE-2026-41850 | High | 7.5 | 2026-06-09 | Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a… |
CVE-2026-41849 | High | 7.5 | 2026-06-09 | An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a speciall… |
CVE-2026-41842 | High | 7.5 | 2026-06-09 | Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Framework 7.0… |
CVE-2024-22233 | High | 7.5 | 2024-01-22 | In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) co… |
CVE-2020-5398 | High | 7.5 | 2020-01-17 | In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a refle… |
CVE-2026-41845 | High | 7.1 | 2026-06-09 | Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross… |
CVE-2026-41846 | Medium | 5.9 | 2026-06-09 | Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScri… |
CVE-2026-41843 | Medium | 5.9 | 2026-06-09 | Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 throug… |
CVE-2026-41841 | Medium | 5.9 | 2026-06-09 | Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0… |
CVE-2026-41840 | Medium | 5.9 | 2026-06-09 | Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 thr… |
CVE-2026-22737 | Medium | 5.9 | 2026-03-20 | Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from… |
CVE-2026-41853 | Medium | 5.3 | 2026-06-09 | Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 thro… |
CVE-2026-41851 | Medium | 5.3 | 2026-06-09 | Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation o… |
CVE-2023-34053 | Medium | 5.3 | 2023-11-28 | In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) cond… |
CVE-2020-5397 | Medium | 5.3 | 2020-01-17 | Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or… |
CVE-2026-41847 | Medium | 4.8 | 2026-06-09 | Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48. |