# org.springframework:spring-web (Maven) vulnerabilities

13 known vulnerabilities (1 critical, 3 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.springframework/spring-web

## Advisories (13)

### [CVE-2026-41854](https://cve.now/CVE-2026-41854): Spring Framework Server-Side Request Forgery via UriComponentsBuilder

- Severity: Medium 4.2
- Published: Jun 9, 2026
- Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19.

### [CVE-2025-41234](https://cve.now/CVE-2025-41234): RFD Attack via “Content-Disposition” Header Sourced from Request

- Severity: Medium 6.5
- Published: Jun 12, 2025
- Affected: from 6.2.0, fixed in 6.2.8; from 6.1.0, fixed in 6.1.21; from 6.0.5, through 6.0.23.

### [CVE-2024-38820](https://cve.now/CVE-2024-38820): CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

- Severity: Low 3.1
- Published: Oct 18, 2024
- Affected: from 6.1.0, fixed in 6.1.14; from 6.0.0, through 6.0.24; through 5.3.40.

### [CVE-2024-38809](https://cve.now/CVE-2024-38809): Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.

- Severity: Medium 5.3
- Published: Sep 27, 2024
- Affected: fixed in 5.3.38; from 6.0.0, fixed in 6.0.23; from 6.1.0, fixed in 6.1.12.

### [CVE-2024-22262](https://cve.now/CVE-2024-22262): CVE-2024-22262: Spring Framework URL Parsing with Host Validation

- Severity: High 8.1
- Published: Apr 16, 2024
- Affected: fixed in 5.3.34; from 6.0.0, fixed in 6.0.19; from 6.1.0, fixed in 6.1.6.

### [CVE-2024-22259](https://cve.now/CVE-2024-22259): CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)

- Severity: High 8.1
- Published: Mar 16, 2024
- Affected: from 6.1.0, fixed in 6.1.5; from 6.0.0, fixed in 6.0.18; fixed in 5.3.33.

### [CVE-2024-22243](https://cve.now/CVE-2024-22243): CVE-2024-22243: Spring Framework URL Parsing with Host Validation

- Severity: High 8.1
- Published: Feb 23, 2024
- Affected: from 6.1.0, fixed in 6.1.4; from 6.0.0, fixed in 6.0.17; from 5.3.0, fixed in 5.3.32; through 5.2.25.RELEASE.

### [CVE-2021-22118](https://cve.now/CVE-2021-22118): In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege…

- Severity: Unrated
- Published: May 27, 2021
- Affected: from 5.2.0, fixed in 5.2.15; from 5.3.0, fixed in 5.3.7.

### [CVE-2013-6430](https://cve.now/CVE-2013-6430): The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not…

- Severity: Unrated
- Published: Jan 10, 2020
- Affected: fixed in 3.2.2.RELEASE.

### [CVE-2016-1000027](https://cve.now/CVE-2016-1000027): Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untru

- Severity: Critical 9.8
- Published: Jan 2, 2020
- Affected: fixed in 6.0.0.

### [CVE-2018-11039](https://cve.now/CVE-2018-11039): Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to c

- Severity: Unrated
- Published: Jun 25, 2018
- Affected: from 5.0.0, fixed in 5.0.7; from 4.3.0, fixed in 4.3.18.

### [CVE-2015-3192](https://cve.now/CVE-2015-3192): Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely…

- Severity: Unrated
- Published: Jul 12, 2016
- Affected: fixed in 3.2.14; from 4.0.0, fixed in 4.1.7; from 5.0.0.RC2, fixed in 5.0.0.RC3.

### [CVE-2013-6429](https://cve.now/CVE-2013-6429): The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external…

- Severity: Unrated
- Published: Jan 26, 2014
- Affected: fixed in 3.2.5.RELEASE.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.springframework:spring-web
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.