Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.springframework:spring-core

19 known vulnerabilities (3 high, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
19 · 3 high, 1 low
Registry
Maven Central

Advisories 19

  • Spring Framework Denial of Service via AntPathMatcher

    Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39.

  • CVE-2025-41249: Spring Framework Annotation Detection Vulnerability

    Affected: from 5.3.0, through 5.3.44; from 6.0.0, through 6.1.22; from 6.2.0, fixed in 6.2.11.

  • CVE-2024-22233: Spring Framework server Web DoS Vulnerability

    Affected: from 6.1.2, fixed in 6.1.3; from 6.0.15, fixed in 6.0.16.

  • In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide…

    Affected: from 5.3.0, fixed in 5.3.14; from 5.2.0, fixed in 5.2.19.

  • In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide…

    Affected: from 5.3.0, fixed in 5.3.11; from 5.2.0, fixed in 5.2.18.

  • DoS Attack via Range Requests

    Affected: from 5.1.0.RELEASE, fixed in 5.1.1.RELEASE; from 5.0.0.RELEASE, fixed in 5.0.10.RELEASE; from 4.2.0.RELEASE, fixed in 4.3.20.RELEASE.

  • Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable

    Affected: from 5.0.0.RELEASE, fixed in 5.0.7.RELEASE; from 4.3.0.RELEASE, fixed in 4.3.18.RELEASE.

  • Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using…

    Affected: from 5.0.5.RELEASE, fixed in 5.0.6.RELEASE.

  • Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expos

    Affected: from 5.0.0, fixed in 5.0.6; fixed in 4.3.17.

  • Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support…

    Affected: fixed in 4.3.15; from 5.0.0, fixed in 5.0.5.

  • Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to…

    Affected: from 5.0.0, fixed in 5.0.5; fixed in 4.3.15.

  • Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14…

    Affected: from 4.3.0, fixed in 4.3.14; from 5.0.0, fixed in 5.0.3.

  • Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for…

    Affected: fixed in 4.3.1.

  • Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable…

    Affected: from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.8; fixed in 3.2.15.

  • The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to…

    Affected: from 4.1.0, fixed in 4.1.5.

Show all 19 advisoriesShow fewer advisories

  • Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read…

    Affected: from 3.0.0, fixed in 3.2.9; from 4.0.0, fixed in 4.0.5.

  • VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language…

    Affected: from 3.0.0, fixed in 3.0.6; fixed in 2.5.6.SEC03; from 2.5.7.SR0, fixed in 2.5.7.SR023.

  • Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize…

    Affected: from 3.0.0, fixed in 3.0.6.

  • Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used…

    Affected: from 1.1.0, fixed in 3.0.0.RELEASE.