# org.springframework:spring-core (Maven) vulnerabilities 19 known vulnerabilities (3 high, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://central.sonatype.com/artifact/org.springframework/spring-core ## Advisories (19) ### [CVE-2026-41848](https://cve.now/CVE-2026-41848): Spring Framework Denial of Service via AntPathMatcher - Severity: Low 3.7 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. ### [CVE-2025-41249](https://cve.now/CVE-2025-41249): CVE-2025-41249: Spring Framework Annotation Detection Vulnerability - Severity: High 7.5 - Published: Sep 16, 2025 - Affected: from 5.3.0, through 5.3.44; from 6.0.0, through 6.1.22; from 6.2.0, fixed in 6.2.11. ### [CVE-2024-22233](https://cve.now/CVE-2024-22233): CVE-2024-22233: Spring Framework server Web DoS Vulnerability - Severity: High 7.5 - Published: Jan 22, 2024 - Affected: from 6.1.2, fixed in 6.1.3; from 6.0.15, fixed in 6.0.16. ### [CVE-2021-22060](https://cve.now/CVE-2021-22060): In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide… - Severity: Unrated - Published: Jan 7, 2022 - Affected: from 5.3.0, fixed in 5.3.14; from 5.2.0, fixed in 5.2.19. ### [CVE-2021-22096](https://cve.now/CVE-2021-22096): In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide… - Severity: Unrated - Published: Oct 28, 2021 - Affected: from 5.3.0, fixed in 5.3.11; from 5.2.0, fixed in 5.2.18. ### [CVE-2018-15756](https://cve.now/CVE-2018-15756): DoS Attack via Range Requests - Severity: High 7.5 - Published: Oct 18, 2018 - Affected: from 5.1.0.RELEASE, fixed in 5.1.1.RELEASE; from 5.0.0.RELEASE, fixed in 5.0.10.RELEASE; from 4.2.0.RELEASE, fixed in 4.3.20.RELEASE. ### [CVE-2018-11040](https://cve.now/CVE-2018-11040): Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable - Severity: Unrated - Published: Jun 25, 2018 - Affected: from 5.0.0.RELEASE, fixed in 5.0.7.RELEASE; from 4.3.0.RELEASE, fixed in 4.3.18.RELEASE. ### [CVE-2018-1258](https://cve.now/CVE-2018-1258): Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using… - Severity: Unrated - Published: May 11, 2018 - Affected: from 5.0.5.RELEASE, fixed in 5.0.6.RELEASE. ### [CVE-2018-1257](https://cve.now/CVE-2018-1257): Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expos - Severity: Unrated - Published: May 11, 2018 - Affected: from 5.0.0, fixed in 5.0.6; fixed in 4.3.17. ### [CVE-2018-1272](https://cve.now/CVE-2018-1272): Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support… - Severity: Unrated - Published: Apr 6, 2018 - Affected: fixed in 4.3.15; from 5.0.0, fixed in 5.0.5. ### [CVE-2018-1271](https://cve.now/CVE-2018-1271): Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to… - Severity: Unrated - Published: Apr 6, 2018 - Affected: from 5.0.0, fixed in 5.0.5; fixed in 4.3.15. ### [CVE-2018-1199](https://cve.now/CVE-2018-1199): Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14… - Severity: Unrated - Published: Mar 16, 2018 - Affected: from 4.3.0, fixed in 4.3.14; from 5.0.0, fixed in 5.0.3. ### [CVE-2016-5007](https://cve.now/CVE-2016-5007): Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for… - Severity: Unrated - Published: May 25, 2017 - Affected: fixed in 4.3.1. ### [CVE-2015-5211](https://cve.now/CVE-2015-5211): Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable… - Severity: Unrated - Published: May 25, 2017 - Affected: from 4.2.0, fixed in 4.2.2; from 4.0.0, fixed in 4.1.8; fixed in 3.2.15. ### [CVE-2015-0201](https://cve.now/CVE-2015-0201): The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to… - Severity: Unrated - Published: Mar 10, 2015 - Affected: from 4.1.0, fixed in 4.1.5. ### [CVE-2014-3578](https://cve.now/CVE-2014-3578): Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read… - Severity: Unrated - Published: Feb 19, 2015 - Affected: from 3.0.0, fixed in 3.2.9; from 4.0.0, fixed in 4.0.5. ### [CVE-2011-2730](https://cve.now/CVE-2011-2730): VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language… - Severity: Unrated - Published: Dec 5, 2012 - Affected: from 3.0.0, fixed in 3.0.6; fixed in 2.5.6.SEC03; from 2.5.7.SR0, fixed in 2.5.7.SR023. ### [CVE-2011-2894](https://cve.now/CVE-2011-2894): Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize… - Severity: Unrated - Published: Oct 4, 2011 - Affected: from 3.0.0, fixed in 3.0.6. ### [CVE-2009-1190](https://cve.now/CVE-2009-1190): Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used… - Severity: Unrated - Published: Apr 27, 2009 - Affected: from 1.1.0, fixed in 3.0.0.RELEASE. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.springframework:spring-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.