Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.springframework:spring-web

13 known vulnerabilities (1 critical, 3 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
13 · 1 critical, 3 high, 3 medium, 1 low
Registry
Maven Central

Advisories 13

  • CVE-2026-41854Medium 4.2

    Spring Framework Server-Side Request Forgery via UriComponentsBuilder

    Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19.

  • CVE-2025-41234Medium 6.5

    RFD Attack via “Content-Disposition” Header Sourced from Request

    Affected: from 6.2.0, fixed in 6.2.8; from 6.1.0, fixed in 6.1.21; from 6.0.5, through 6.0.23.

  • CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

    Affected: from 6.1.0, fixed in 6.1.14; from 6.0.0, through 6.0.24; through 5.3.40.

  • CVE-2024-38809Medium 5.3

    Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.

    Affected: fixed in 5.3.38; from 6.0.0, fixed in 6.0.23; from 6.1.0, fixed in 6.1.12.

  • CVE-2024-22262: Spring Framework URL Parsing with Host Validation

    Affected: fixed in 5.3.34; from 6.0.0, fixed in 6.0.19; from 6.1.0, fixed in 6.1.6.

  • CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)

    Affected: from 6.1.0, fixed in 6.1.5; from 6.0.0, fixed in 6.0.18; fixed in 5.3.33.

  • CVE-2024-22243: Spring Framework URL Parsing with Host Validation

    Affected: from 6.1.0, fixed in 6.1.4; from 6.0.0, fixed in 6.0.17; from 5.3.0, fixed in 5.3.32; through 5.2.25.RELEASE.

  • In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege…

    Affected: from 5.2.0, fixed in 5.2.15; from 5.3.0, fixed in 5.3.7.

  • The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not…

    Affected: fixed in 3.2.2.RELEASE.

  • CVE-2016-1000027Critical 9.8

    Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untru

    Affected: fixed in 6.0.0.

  • Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to c

    Affected: from 5.0.0, fixed in 5.0.7; from 4.3.0, fixed in 4.3.18.

  • Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely…

    Affected: fixed in 3.2.14; from 4.0.0, fixed in 4.1.7; from 5.0.0.RC2, fixed in 5.0.0.RC3.

  • The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external…

    Affected: fixed in 3.2.5.RELEASE.