Spring
Page 2 of 3 — Spring CVEs from a corpus of 245, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41700 | High | 8.1 | 2026-06-11 | Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authentica… |
CVE-2026-41699 | High | 8.1 | 2026-06-11 | Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL r… |
CVE-2026-41001 | Medium | 5.3 | 2026-06-11 | Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is c… |
CVE-2026-41000 | Low | 3.7 | 2026-06-11 | Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections aga… |
CVE-2026-40999 | High | 8.6 | 2026-06-11 | When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSen… |
CVE-2026-40998 | High | 8.2 | 2026-06-11 | Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's defa… |
CVE-2026-40997 | Medium | 5.3 | 2026-06-11 | Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP cl… |
CVE-2026-40996 | Medium | 4.8 | 2026-06-11 | Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Secu… |
CVE-2026-40995 | Medium | 5.4 | 2026-06-11 | X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Sprin… |
CVE-2026-40994 | High | 8.2 | 2026-06-11 | Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on Request… |
CVE-2026-40992 | Medium | 5.0 | 2026-06-11 | Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properti… |
CVE-2026-40987 | High | 7.1 | 2026-06-11 | A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attack… |
CVE-2026-40986 | Medium | 4.8 | 2026-06-11 | Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scr… |
CVE-2026-40985 | Medium | 6.4 | 2026-06-11 | Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4… |
CVE-2026-47838 | Medium | 6.8 | 2026-06-10 | SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the user… |
CVE-2026-41837 | Medium | 5.3 | 2026-06-10 | Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizatio… |
CVE-2026-41732 | High | 8.1 | 2026-06-10 | JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subp… |
CVE-2026-41731 | High | 8.1 | 2026-06-10 | JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any… |
CVE-2026-41730 | Medium | 5.3 | 2026-06-10 | Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. … |
CVE-2026-41729 | High | 8.1 | 2026-06-10 | Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. Whe… |
CVE-2026-41728 | High | 7.5 | 2026-06-10 | Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving… |
CVE-2026-41727 | Medium | 6.5 | 2026-06-10 | Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record wit… |
CVE-2026-41726 | Medium | 6.5 | 2026-06-10 | When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka… |
CVE-2026-41721 | Medium | 5.9 | 2026-06-10 | Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a C… |
CVE-2026-41719 | Medium | 6.4 | 2026-06-10 | A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates eva… |
CVE-2026-41717 | High | 8.1 | 2026-06-10 | Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defi… |
CVE-2026-41716 | High | 7.5 | 2026-06-10 | Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated… |
CVE-2026-41714 | Medium | 4.0 | 2026-06-10 | Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encrypti… |
CVE-2026-41711 | Medium | 5.9 | 2026-06-10 | Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters. … |
CVE-2026-41706 | Medium | 6.1 | 2026-06-10 | Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected… |
CVE-2026-41701 | Medium | 4.4 | 2026-06-10 | Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected version… |
CVE-2026-41697 | Medium | 4.8 | 2026-06-10 | Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Que… |
CVE-2026-41696 | Medium | 5.9 | 2026-06-10 | Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An… |
CVE-2026-41695 | High | 7.5 | 2026-06-10 | Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed t… |
CVE-2026-41694 | Low | 3.7 | 2026-06-10 | Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attacker… |
CVE-2026-41008 | Medium | 6.1 | 2026-06-10 | Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious… |
CVE-2026-41003 | High | 7.6 | 2026-06-10 | An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affecte… |
CVE-2026-40993 | High | 7.3 | 2026-06-10 | An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store… |
CVE-2026-40991 | Medium | 5.9 | 2026-06-10 | When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tri… |
CVE-2026-40988 | High | 7.5 | 2026-06-10 | An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by w… |
CVE-2026-41855 | High | 8.1 | 2026-06-09 | In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.Jackso… |
CVE-2026-41854 | Medium | 4.2 | 2026-06-09 | Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a serve… |
CVE-2026-41853 | Medium | 5.3 | 2026-06-09 | Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 thro… |
CVE-2026-41852 | Low | 3.7 | 2026-06-09 | A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only… |
CVE-2026-41851 | Medium | 5.3 | 2026-06-09 | Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation o… |
CVE-2026-41850 | High | 7.5 | 2026-06-09 | Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a… |
CVE-2026-41849 | High | 7.5 | 2026-06-09 | An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a speciall… |
CVE-2026-41848 | Low | 3.7 | 2026-06-09 | Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is then directly or i… |
CVE-2026-41847 | Medium | 4.8 | 2026-06-09 | Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48. |
CVE-2026-41846 | Medium | 5.9 | 2026-06-09 | Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScri… |
CVE-2026-41845 | High | 7.1 | 2026-06-09 | Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross… |
CVE-2026-41844 | Medium | 4.2 | 2026-06-09 | A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a l… |
CVE-2026-41843 | Medium | 5.9 | 2026-06-09 | Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 throug… |
CVE-2026-41842 | High | 7.5 | 2026-06-09 | Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Framework 7.0… |
CVE-2026-41841 | Medium | 5.9 | 2026-06-09 | Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0… |
CVE-2026-41840 | Medium | 5.9 | 2026-06-09 | Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 thr… |
CVE-2026-41839 | Medium | 4.2 | 2026-06-09 | A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a… |
CVE-2026-41838 | Medium | 4.8 | 2026-06-09 | IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequ… |
CVE-2026-41720 | High | 7.4 | 2026-06-09 | Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password… |
CVE-2026-41715 | Medium | 6.1 | 2026-06-09 | In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to… |
CVE-2026-41710 | Medium | 5.9 | 2026-06-09 | An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the… |
CVE-2026-41007 | High | 7.5 | 2026-06-09 | Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0… |
CVE-2026-41006 | High | 7.5 | 2026-06-09 | Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean propert… |
CVE-2026-40984 | High | 7.5 | 2026-06-09 | In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: mic… |
CVE-2026-40983 | High | 7.5 | 2026-06-09 | In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Mic… |
CVE-2026-40990 | Medium | 5.7 | 2026-06-01 | OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function… |
CVE-2026-40989 | Medium | 5.7 | 2026-06-01 | Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versi… |
CVE-2026-41863 | Medium | 6.5 | 2026-05-25 | Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malic… |
CVE-2026-41705 | High | 8.6 | 2026-05-09 | Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affecte… |
CVE-2026-41004 | Medium | 4.4 | 2026-05-07 | When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from… |
CVE-2026-41002 | High | 7.2 | 2026-05-07 | The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-che… |
CVE-2026-40982 | Critical | 9.1 | 2026-05-07 | Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker… |
CVE-2026-40981 | High | 7.5 | 2026-05-07 | When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secret… |
CVE-2026-40969 | Low | 3.7 | 2026-04-28 | The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an at… |
CVE-2026-40968 | Medium | 4.2 | 2026-04-28 | When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a su… |
CVE-2026-40980 | Medium | 6.5 | 2026-04-28 | In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`. … |
CVE-2026-40979 | Medium | 6.1 | 2026-04-28 | In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1… |
CVE-2026-40978 | High | 8.8 | 2026-04-28 | SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions… |
CVE-2026-40967 | High | 8.6 | 2026-04-28 | In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages… |
CVE-2026-40977 | Medium | 4.7 | 2026-04-28 | When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the… |
CVE-2026-40976 | Critical | 9.1 | 2026-04-28 | In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable… |
CVE-2026-40975 | Medium | 4.8 | 2026-04-28 | Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used f… |
CVE-2026-40974 | Medium | 5.0 | 2026-04-28 | Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot 4.0… |
CVE-2026-40973 | High | 7.0 | 2026-04-28 | A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persi… |
CVE-2026-40972 | High | 7.5 | 2026-04-28 | An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme ci… |
CVE-2026-40971 | Medium | 5.0 | 2026-04-27 | When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. … |
CVE-2026-40970 | Medium | 5.0 | 2026-04-27 | When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearc… |
CVE-2026-22754 | High | 7.5 | 2026-04-22 | Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet… |
CVE-2026-22753 | High | 7.5 | 2026-04-22 | Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet… |
CVE-2026-22748 | Medium | 5.3 | 2026-04-22 | Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an O… |
CVE-2026-22747 | Medium | 6.8 | 2026-04-22 | Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead… |
CVE-2026-22746 | Low | 3.7 | 2026-04-22 | Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked user attributes, to… |
CVE-2026-22751 | Medium | 4.8 | 2026-04-21 | Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-c… |
CVE-2026-22744 | High | 7.5 | 2026-03-27 | In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts th… |
CVE-2026-22743 | High | 7.5 | 2026-03-27 | Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as… |
CVE-2026-22742 | High | 8.6 | 2026-03-27 | Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages… |
CVE-2026-22738 | Critical | 9.8 | 2026-03-27 | In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could… |
CVE-2026-22739 | High | 8.6 | 2026-03-24 | Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file syste… |
CVE-2026-22737 | Medium | 5.9 | 2026-03-20 | Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from… |
CVE-2026-22735 | Low | 2.6 | 2026-03-20 | Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 t… |