# cve.now: Spring

The newest entries affecting Spring (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-96678](https://cve.now/CVE-2026-96678.md): weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal (CVSS 5.3, weiqingwen spring-boot-forum)
- [CVE-2026-90595](https://cve.now/CVE-2026-90595.md): wxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlineInfo authorization (CVSS 5.3, wxiaoqi Spring-Cloud-Platform)
- [CVE-2026-90594](https://cve.now/CVE-2026-90594.md): wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization (CVSS 5.3, wxiaoqi Spring-Cloud-Platform)
- [CVE-2026-69854](https://cve.now/CVE-2026-69854.md): Spring Cloud Azure Elevation of Privilege Vulnerability (CVSS 9.0, Microsoft Spring Cloud Azure)
- [CVE-2026-59315](https://cve.now/CVE-2026-59315.md): Spring Cloud Config Monitor Denial of Service (CVSS 5.3, Spring Cloud Config)
- [CVE-2026-59314](https://cve.now/CVE-2026-59314.md): Spring Framework response splitting in ContentDisposition (CVSS 3.7, Spring Framework)
- [CVE-2026-59306](https://cve.now/CVE-2026-59306.md): Potential for deserialization of untrusted types in Spring Cloud Stream (CVSS 3.1, Spring Cloud Stream)
- [CVE-2026-59313](https://cve.now/CVE-2026-59313.md): Server Sent Event stream corruption in Spring MVC functional web framework (CVSS 9.8, Spring Framework)
- [CVE-2026-59305](https://cve.now/CVE-2026-59305.md): Partition interceptor may be improperly added while sending message (CVSS 3.1, Spring Cloud Stream)
- [CVE-2026-59304](https://cve.now/CVE-2026-59304.md): Improper caching of the original content type in Spring Cloud Stream Avro (CVSS 3.1, Spring Cloud Stream)
- [CVE-2026-59303](https://cve.now/CVE-2026-59303.md): Dynamic destination cache size is not properly bound in Spring Cloud Stream (CVSS 3.1, Spring Cloud Stream)
- [CVE-2026-59302](https://cve.now/CVE-2026-59302.md): Potential for logging sensitive data in Spring Cloud Stream (CVSS 3.1, Spring Cloud Stream)
- [CVE-2026-59301](https://cve.now/CVE-2026-59301.md): Potential for logging sensitive data in Spring Cloud Function Azure (CVSS 3.1, Spring Cloud Function)
- [CVE-2026-59300](https://cve.now/CVE-2026-59300.md): Potential for logging sensitive data in Spring Cloud Function AWS (CVSS 3.1, Spring Cloud Function)
- [CVE-2026-59299](https://cve.now/CVE-2026-59299.md): Composition lookup can potentially poison base function in Spring Cloud Function (CVSS 3.1, Spring Cloud Function)
- [CVE-2026-59298](https://cve.now/CVE-2026-59298.md): Potential for improper filtering of HTTP headers in Spring Cloud Function (CVSS 3.1, Spring Cloud Function)
- [CVE-2026-59297](https://cve.now/CVE-2026-59297.md): Spring Cloud Function can incorrectly determine if URI is secure (CVSS 3.1, Spring Cloud Function)
- [CVE-2026-59291](https://cve.now/CVE-2026-59291.md): Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function (CVSS 2.0, Spring Cloud Function)
- [CVE-2026-59284](https://cve.now/CVE-2026-59284.md): Spring Cloud Commons no allow list for writable env actuator endpoint (CVSS 6.6, Spring Cloud Commons)
- [CVE-2026-59283](https://cve.now/CVE-2026-59283.md): Spring Framework Safety Guard Bypass via SpEL Expression Compilation (CVSS 9.1, Spring Framework)
- [CVE-2026-59282](https://cve.now/CVE-2026-59282.md): Spring Framework Denial of Service via Unbounded List Growth in Data Binding (CVSS 7.5, Spring Framework)
- [CVE-2026-59281](https://cve.now/CVE-2026-59281.md): Spring Framework Cross-site Scripting via EscapedErrors (CVSS 6.1, Spring Framework)
- [CVE-2026-59277](https://cve.now/CVE-2026-59277.md): Spring Security InetAddressMatchers Incomplete Internal Network Classification (CVSS 3.7, Spring Security)
- [CVE-2026-59276](https://cve.now/CVE-2026-59276.md): Timing Attack via Non-Constant-Time Comparison of Sensitive Values (CVSS 5.9, Spring Security)
- [CVE-2026-59280](https://cve.now/CVE-2026-59280.md): Spring Framework Path Traversal via Backslash in SpringTemplateLoader (CVSS 4.3, Spring Framework)
- [CVE-2026-59354](https://cve.now/CVE-2026-59354.md): Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata (CVSS 9.6, VMware by Broadcom Spring Security)
- [CVE-2026-47893](https://cve.now/CVE-2026-47893.md): Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService (CVSS 7.5, Spring Framework)
- [CVE-2026-47892](https://cve.now/CVE-2026-47892.md): Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints (CVSS 9.8, Spring Framework · org.springframework:spring-webflux)
- [CVE-2026-47891](https://cve.now/CVE-2026-47891.md): Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder (CVSS 9.8, Spring Framework)
- [CVE-2026-47890](https://cve.now/CVE-2026-47890.md): Spring Framework Server Sent Event stream corruption while rendering fragments (CVSS 9.8, Spring Framework · org.springframework:spring-webflux +1)
- [CVE-2026-47889](https://cve.now/CVE-2026-47889.md): Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse (CVSS 7.5, Spring Framework)
- [CVE-2026-47888](https://cve.now/CVE-2026-47888.md): Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler (CVSS 7.5, Spring Framework)
- [CVE-2026-47887](https://cve.now/CVE-2026-47887.md): Spring Framework Open Redirect in UrlFileNameViewController (CVSS 6.1, Spring Framework)
- [CVE-2026-47886](https://cve.now/CVE-2026-47886.md): Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions (CVSS 7.5, Spring Framework)
- [CVE-2026-47885](https://cve.now/CVE-2026-47885.md): Spring Framework maxPartSize Ignored in PartEventHttpMessageReader (CVSS 7.5, Spring Framework)
- [CVE-2026-47884](https://cve.now/CVE-2026-47884.md): Spring Framework Improper Path Limitation in XsltView (CVSS 9.8, Spring Framework · org.springframework:spring-webmvc)
- [CVE-2026-47883](https://cve.now/CVE-2026-47883.md): Spring Framework Open Redirect in UrlHandlerFilter (CVSS 6.1, Spring Framework)
- [CVE-2026-59270](https://cve.now/CVE-2026-59270.md): Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces (CVSS 9.4, Spring Security)
- [CVE-2026-47894](https://cve.now/CVE-2026-47894.md): Spring Cloud Config Server Native Environment Repository Exposure (CVSS 4.9, Spring Cloud Config)
- [CVE-2026-47879](https://cve.now/CVE-2026-47879.md): Spring Cloud Gateway SSRF and native file access with gRPC (CVSS 7.7, Spring Cloud Gateway)
- [CVE-2026-47877](https://cve.now/CVE-2026-47877.md): Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) (CVSS 8.2, Spring Security)
- [CVE-2026-47842](https://cve.now/CVE-2026-47842.md): Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation (CVSS 6.5, Spring Security)
- [CVE-2026-47841](https://cve.now/CVE-2026-47841.md): WebAuthn User Verification Bypass via Session Serialization (CVSS 7.4, Spring Security)
- [CVE-2026-47837](https://cve.now/CVE-2026-47837.md): Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests (CVSS 6.8, Spring Cloud Config)
- [CVE-2026-47836](https://cve.now/CVE-2026-47836.md): Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN (CVSS 7.2, Spring Cloud Config)
- [CVE-2026-41707](https://cve.now/CVE-2026-41707.md): Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay (CVSS 7.4, Spring Security)
- [CVE-2026-62242](https://cve.now/CVE-2026-62242.md): Spring Boot Admin Server \< 4.1.2 SSRF via Unauthenticated Instance Registration (CVSS 7.7, codecentric spring-boot-admin)
- [CVE-2026-47825](https://cve.now/CVE-2026-47825.md): Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations (CVSS 8.6, Spring Cloud Gateway)
- [CVE-2026-41708](https://cve.now/CVE-2026-41708.md): Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability (CVSS 7.5, Spring Cloud Sleuth · org.springframework.cloud:spring-clou…)
- [CVE-2026-41001](https://cve.now/CVE-2026-41001.md): Predictable Temp Directory in Artemis Auto-configuration (CVSS 5.3, Spring Boot · org.springframework.boot:spring-boot-autoconf…)
- [CVE-2026-40992](https://cve.now/CVE-2026-40992.md): Mail Auto-Configuration Does Not Enable SSL Hostname Verification (CVSS 5.0, Spring Boot · org.springframework.boot:spring-boot-starter-…)
- [CVE-2026-47838](https://cve.now/CVE-2026-47838.md): Unauthorized User Impersonation when Using X.509 Client Certificates (CVSS 6.8, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-41706](https://cve.now/CVE-2026-41706.md): Open Redirect When Using CookieRequestCache (CVSS 6.1, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-41694](https://cve.now/CVE-2026-41694.md): SAML Payloads Decrypted Without Valid Signature (CVSS 3.7, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-41008](https://cve.now/CVE-2026-41008.md): Spring Security Authorization Server Open Redirect via request\_uri (CVSS 6.1, Spring Security · Spring Authorization Server +1)
- [CVE-2026-41003](https://cve.now/CVE-2026-41003.md): Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting (CVSS 7.6, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-40993](https://cve.now/CVE-2026-40993.md): Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry (CVSS 7.3, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-40988](https://cve.now/CVE-2026-40988.md): Unbounded DEFLATE Inflation in SAML 2.0 Service Provider (CVSS 7.5, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-41855](https://cve.now/CVE-2026-41855.md): Spring Framework Unsafe Deserialization via Jackson JMS Converters (CVSS 8.1, Spring Framework · org.springframework:spring-jms)
- [CVE-2026-41854](https://cve.now/CVE-2026-41854.md): Spring Framework Server-Side Request Forgery via UriComponentsBuilder (CVSS 4.2, Spring Framework · org.springframework:spring-web)
- [CVE-2026-41853](https://cve.now/CVE-2026-41853.md): Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux (CVSS 5.3, Spring Framework · org.springframework:spring-webmvc +1)
- [CVE-2026-41852](https://cve.now/CVE-2026-41852.md): Spring Framework Arbitrary Method Invocation in SpEL Expressions (CVSS 3.7, Spring Framework · org.springframework:spring-expression)
- [CVE-2026-41851](https://cve.now/CVE-2026-41851.md): Spring Framework Denial of Service via Unbounded Cache in SpEL (CVSS 5.3, Spring Framework · org.springframework:spring-expression)
- [CVE-2026-41850](https://cve.now/CVE-2026-41850.md): Spring Framework Algorithmic Denial of Service via SpEL Expressions (CVSS 7.5, Spring Framework · org.springframework:spring-expression)
- [CVE-2026-41849](https://cve.now/CVE-2026-41849.md): Spring Framework Denial of Service via Integer Overflow in SpEL Expressions (CVSS 7.5, Spring Framework · org.springframework:spring-expression)
- [CVE-2026-41848](https://cve.now/CVE-2026-41848.md): Spring Framework Denial of Service via AntPathMatcher (CVSS 3.7, Spring Framework · org.springframework:spring-core)
- [CVE-2026-41847](https://cve.now/CVE-2026-41847.md): Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL (CVSS 4.8, Spring Framework · org.springframework:spring-webflux)
- [CVE-2026-41846](https://cve.now/CVE-2026-41846.md): Spring Framework Cross-site Scripting via JSP Form Tags (CVSS 5.9, Spring Framework · org.springframework:spring-webmvc)
- [CVE-2026-41845](https://cve.now/CVE-2026-41845.md): Spring Framework Cross-site Scripting via JavaScriptUtils (CVSS 7.1, Spring Framework · org.springframework:spring-webmvc)
- [CVE-2026-41844](https://cve.now/CVE-2026-41844.md): Spring Framework Open Redirect in Spring MVC and WebFlux (CVSS 4.2, Spring Framework · org.springframework:spring-webmvc +1)
- [CVE-2026-41843](https://cve.now/CVE-2026-41843.md): Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux (CVSS 5.9, Spring Framework · org.springframework:spring-webmvc +1)
- [CVE-2026-41842](https://cve.now/CVE-2026-41842.md): Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux (CVSS 7.5, Spring Framework · org.springframework:spring-webmvc +1)
- [CVE-2026-41841](https://cve.now/CVE-2026-41841.md): Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux (CVSS 5.9, Spring Framework · org.springframework:spring-webmvc +1)
- [CVE-2026-41840](https://cve.now/CVE-2026-41840.md): Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. (CVSS 5.9, Spring Framework · org.springframework:spring-webflux)
- [CVE-2026-41839](https://cve.now/CVE-2026-41839.md): Spring Framework Escalation via Session Fixation in WebFlux (CVSS 4.2, Spring Framework · org.springframework:spring-webflux)
- [CVE-2026-41838](https://cve.now/CVE-2026-41838.md): Spring Framework Predictable Session ID in WebSocket Module (CVSS 4.8, Spring Framework · org.springframework:spring-websocket)
- [CVE-2026-40990](https://cve.now/CVE-2026-40990.md): Unbounded cache for function definitions (CVSS 5.7, Spring Cloud Function · org.springframework.cloud:spring-cl…)
- [CVE-2026-40989](https://cve.now/CVE-2026-40989.md): Self Routing guard bypassed via function composition (CVSS 5.7, Spring Cloud Function · org.springframework.cloud:spring-cl…)
- [CVE-2026-44308](https://cve.now/CVE-2026-44308.md): Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications (CVSS 6.3, awspring spring-cloud-aws · io.awspring.cloud spring-clo… +1)
- [CVE-2026-40981](https://cve.now/CVE-2026-40981.md): When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentia (CVSS 7.5, Spring Cloud Config · org.springframework.cloud:spring-clou…)
- [CVE-2026-41002](https://cve.now/CVE-2026-41002.md): The base directory (\`spring.cloud.config.server.git.basedir\`) used by the Spring Cloud Config Server to clone Git repositories to is suscept (CVSS 7.4, Spring Cloud Config · org.springframework.cloud:spring-clou…)
- [CVE-2026-41004](https://cve.now/CVE-2026-41004.md): When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. (CVSS 4.4, Spring Cloud Config · org.springframework.cloud:spring-clou…)
- [CVE-2026-40982](https://cve.now/CVE-2026-40982.md): Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. (CVSS 9.1, Spring Cloud Config · org.springframework.cloud:spring-clou…)
- [CVE-2026-22745](https://cve.now/CVE-2026-22745.md): CVE-2026-22745 : Denial of service in static resource handling on Windows platforms (CVSS 5.3, VMware Spring Framework · org.springframework:spring-web… +1)
- [CVE-2026-22741](https://cve.now/CVE-2026-22741.md): Static resource cache poisoning in Spring MVC and WebFlux (CVSS 3.1, VMware Spring Framework · org.springframework:spring-web… +1)
- [CVE-2026-22740](https://cve.now/CVE-2026-22740.md): Spring Framework DoS with Multipart Temp Files in WebFlux (CVSS 6.5, VMware Spring Framework · org.springframework:spring-webflux)
- [CVE-2026-40977](https://cve.now/CVE-2026-40977.md): When an application is configured to use \`ApplicationPidFileWriter\`, a local attacker with write access to the PID file's location can corru (CVSS 4.7, Spring Boot · org.springframework.boot:spring-boot-cassandra)
- [CVE-2026-40976](https://cve.now/CVE-2026-40976.md): In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. (CVSS 9.1, Spring Boot · org.springframework.boot:spring-boot)
- [CVE-2026-40975](https://cve.now/CVE-2026-40975.md): Values produced by ${random.value} are not suitable for use as secrets. (CVSS 4.8, Spring Boot · org.springframework.boot:spring-boot-cassandra)
- [CVE-2026-40974](https://cve.now/CVE-2026-40974.md): Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. (CVSS 5.0, Spring Boot · org.springframework.boot:spring-boot-cassandra)
- [CVE-2026-40973](https://cve.now/CVE-2026-40973.md): A local attacker on the same host as the application may be able to take control of the directory used by \`ApplicationTemp\`. (CVSS 7.0, Spring Boot · org.springframework.boot:spring-boot)
- [CVE-2026-40972](https://cve.now/CVE-2026-40972.md): An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote se (CVSS 7.5, Spring Boot · org.springframework.boot:spring-boot-devtools)
- [CVE-2026-40971](https://cve.now/CVE-2026-40971.md): When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to th (CVSS 5.0, Spring Boot · org.springframework.boot:spring-boot-rabbitmq)
- [CVE-2026-40970](https://cve.now/CVE-2026-40970.md): When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting (CVSS 5.0, Spring Boot · org.springframework.boot:spring-boot-elastics…)
- [CVE-2026-22754](https://cve.now/CVE-2026-22754.md): ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules (CVSS 7.5, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-22753](https://cve.now/CVE-2026-22753.md): Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers (CVSS 7.5, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-22748](https://cve.now/CVE-2026-22748.md): Potential Security Misconfiguration when Using withIssuerLocation (CVSS 5.3, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-22747](https://cve.now/CVE-2026-22747.md): Unauthorized User Impersonation when Using X.509 Client Certificates (CVSS 6.8, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-22746](https://cve.now/CVE-2026-22746.md): User Attribute Enumeration when Using DaoAuthenticationProvider (CVSS 3.7, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-22751](https://cve.now/CVE-2026-22751.md): Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions (CVSS 4.8, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2026-22750](https://cve.now/CVE-2026-22750.md): SSL bundle configuration silently bypassed in Spring Cloud Gateway (CVSS 7.5, VMware Spring Cloud Gateway · org.springframework.cloud:spr…)
- [CVE-2026-22739](https://cve.now/CVE-2026-22739.md): Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks (CVSS 8.6, Spring Cloud · org.springframework.cloud:spring-cloud-confi…)
- [CVE-2026-22737](https://cve.now/CVE-2026-22737.md): Spring Framework Improper Path Limitation with Script View Templates (CVSS 5.9, Spring Framework · org.springframework:spring-webmvc +1)
- [CVE-2026-22733](https://cve.now/CVE-2026-22733.md): Authentication Bypass under Actuator CloudFoundry endpoints (CVSS 8.2, Spring Security · org.springframework.boot:spring-boot-star…)
- [CVE-2026-22732](https://cve.now/CVE-2026-22732.md): Under Some Conditions Spring Security HTTP Headers Are not Written (CVSS 9.1, VMware Spring Security · org.springframework.security:sprin…)
- [CVE-2026-22731](https://cve.now/CVE-2026-22731.md): Authentication Bypass under Actuator Health groups paths (CVSS 8.2, Spring Boot · org.springframework.boot:spring-boot-starter-…)
- [CVE-2025-22234](https://cve.now/CVE-2025-22234.md): Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation (CVSS 5.3, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2025-41254](https://cve.now/CVE-2025-41254.md): Spring Framework STOMP CSRF Vulnerability (CVSS 4.3, VMware Spring Framework · org.springframework:spring-websoc…)
- [CVE-2025-41253](https://cve.now/CVE-2025-41253.md): Spring Cloud Gateway Webflux SpEL Injection Vulnerability Allowing Exposure of Environment Variables (CVSS 7.5, VMware Spring Cloud Gateway Server Webflux · org.springfram…)
- [CVE-2025-41249](https://cve.now/CVE-2025-41249.md): CVE-2025-41249: Spring Framework Annotation Detection Vulnerability (CVSS 7.5, VMware Spring Framework · org.springframework:spring-core)
- [CVE-2025-41248](https://cve.now/CVE-2025-41248.md): CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types (CVSS 7.5, VMware Spring Security · org.springframework.security:sprin…)
- [CVE-2025-41242](https://cve.now/CVE-2025-41242.md): CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers (CVSS 5.9, VMware Spring Framework · org.springframework:spring-webmvc)
- [CVE-2025-6108](https://cve.now/CVE-2025-6108.md): hansonwang99 Spring-Boot-In-Action File Upload ImageUploadService.java watermarkTest path traversal (CVSS 5.3, hansonwang99 Spring-Boot-In-Action)
- [CVE-2025-41234](https://cve.now/CVE-2025-41234.md): RFD Attack via “Content-Disposition” Header Sourced from Request (CVSS 6.5, VMware Spring Framework · org.springframework:spring-web)
- [CVE-2025-41235](https://cve.now/CVE-2025-41235.md): CVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies (CVSS 8.6, VMware Spring cloud Gateway · org.springframework.cloud:… +1)
- [CVE-2025-41232](https://cve.now/CVE-2025-41232.md): CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods (CVSS 9.1, Spring Security · org.springframework.security:spring-se… +1)
- [CVE-2025-22233](https://cve.now/CVE-2025-22233.md): Spring Framework DataBinder Case Sensitive Match Exception (CVSS 3.1, Spring Framework · org.springframework:spring-context)
- [CVE-2025-4511](https://cve.now/CVE-2025-4511.md): vector4wang spring-boot-quick quick-img2txt Img2TxtController.java ResponseEntity path traversal (CVSS 5.3, vector4wang spring-boot-quick)
- [CVE-2025-4328](https://cve.now/CVE-2025-4328.md): fp2952 spring-cloud-base HTTP Header MvcController.java sendBack redirect (CVSS 5.1, fp2952 spring-cloud-base)
- [CVE-2025-4175](https://cve.now/CVE-2025-4175.md): AlanBinu007 Spring-Boot-Advanced-Projects Upload Profile API Endpoint UserProfileController.java uploadUserProfileImage path traversal (CVSS 5.3, AlanBinu007 Spring-Boot-Advanced-Projects)
- [CVE-2025-22235](https://cve.now/CVE-2025-22235.md): Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed (CVSS 7.3, Spring Boot · org.springframework.boot:spring-boot)
- [CVE-2025-22232](https://cve.now/CVE-2025-22232.md): Spring Cloud Config Server May Not Use Vault Token Sent By Clients (CVSS 5.3, Spring Cloud Config)
- [CVE-2025-22223](https://cve.now/CVE-2025-22223.md): Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. (CVSS 5.3, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2025-22228](https://cve.now/CVE-2025-22228.md): CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length (CVSS 7.4, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2024-38819](https://cve.now/CVE-2024-38819.md): Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks (CVSS 7.5, Spring Framework · org.springframework:spring-webflux +1)
- [CVE-2024-38827](https://cve.now/CVE-2024-38827.md): Spring Security Authorization Bypass for Case Sensitive Comparisons (CVSS 4.8, Spring by VMware Tanzu Spring Security · org.springframewor…)
- [CVE-2024-38820](https://cve.now/CVE-2024-38820.md): CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception (CVSS 3.1, VMware Spring · org.springframework:spring-context +1)
- [CVE-2024-38809](https://cve.now/CVE-2024-38809.md): Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. (CVSS 5.3, Spring Framework · org.springframework:spring-web)
- [CVE-2024-38807](https://cve.now/CVE-2024-38807.md): CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader (CVSS 6.3, Spring Boot · org.springframework.boot:spring-boot-loader +1)
- [CVE-2024-38808](https://cve.now/CVE-2024-38808.md): CVE-2024-38808: Spring Expression DoS Vulnerability (CVSS 4.3, Spring Framework · org.springframework:spring-expression)
- [CVE-2024-38810](https://cve.now/CVE-2024-38810.md): Missing Authorization When Using @AuthorizeReturnObject (CVSS 6.5, spring security · org.springframework.security:spring-secur…)
- [CVE-2024-37084](https://cve.now/CVE-2024-37084.md): CVE-2024-37084: Remote code execution in Spring Cloud Data Flow (CVSS 9.8, Spring Cloud Data Flow · org.springframework.cloud:spring-c…)
- [CVE-2024-22271](https://cve.now/CVE-2024-22271.md): Spring Cloud Function Web DOS Vulnerability (CVSS 8.2, Spring by VMware Tanzu Spring Cloud Function Framework · or…)
- [CVE-2024-22263](https://cve.now/CVE-2024-22263.md): Arbitrary File Write Vulnerability in Spring Cloud Data Flow (CVSS 8.8, Spring by VMware Tanzu Spring Cloud Skipper)
- [CVE-2024-22262](https://cve.now/CVE-2024-22262.md): CVE-2024-22262: Spring Framework URL Parsing with Host Validation (CVSS 8.1, Spring Framework · org.springframework:spring-web)
- [CVE-2024-22257](https://cve.now/CVE-2024-22257.md): In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, v (CVSS 8.2, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2024-22259](https://cve.now/CVE-2024-22259.md): CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report) (CVSS 8.1, Spring Framework · org.springframework:spring-web)
- [CVE-2024-22243](https://cve.now/CVE-2024-22243.md): CVE-2024-22243: Spring Framework URL Parsing with Host Validation (CVSS 8.1, Spring Framework · org.springframework:spring-web)
- [CVE-2024-22234](https://cve.now/CVE-2024-22234.md): CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated (CVSS 7.4, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2023-34042](https://cve.now/CVE-2023-34042.md): The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be wri (CVSS 4.1, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2024-22236](https://cve.now/CVE-2024-22236.md): In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution i (CVSS 3.3, Spring Cloud Contract · org.springframework.cloud:spring-cl…)
- [CVE-2024-22233](https://cve.now/CVE-2024-22233.md): CVE-2024-22233: Spring Framework server Web DoS Vulnerability (CVSS 7.5, Spring Framework · org.springframework:spring-core)
- [CVE-2023-34055](https://cve.now/CVE-2023-34055.md): Spring Boot server Web Observations DoS Vulnerability (CVSS 5.3, Spring Boot · org.springframework.boot:spring-boot-actuator)
- [CVE-2023-34053](https://cve.now/CVE-2023-34053.md): Spring Framework server Web Observations DoS Vulnerability (CVSS 5.3, Spring Framework · org.springframework:spring-webmvc)
- [CVE-2023-34034](https://cve.now/CVE-2023-34034.md): Using "\*\*" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Sp (CVSS 9.1, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2023-34035](https://cve.now/CVE-2023-34035.md): Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfig (CVSS 7.3, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2023-20883](https://cve.now/CVE-2023-20883.md): In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for (CVSS 7.5, Spring Boot · org.springframework.boot:spring-boot-autoconf…)
- [CVE-2023-20873](https://cve.now/CVE-2023-20873.md): In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry coul (CVSS 9.8, Spring Boot · org.springframework.boot:spring-boot-actuator…)
- [CVE-2023-20862](https://cve.now/CVE-2023-20862.md): In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does (CVSS 6.3, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2023-20863](https://cve.now/CVE-2023-20863.md): In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL ex (CVSS 6.5, Spring Framework · org.springframework:spring-expression)
- [CVE-2023-20860](https://cve.now/CVE-2023-20860.md): Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "\*\*" as a pattern in Spring Security configuration with the mvcReques (CVSS 7.5, Spring Framework · org.springframework:spring +1)
- [CVE-2023-20861](https://cve.now/CVE-2023-20861.md): In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible f (no CVSS, Spring Framework · org.springframework:spring-expression)
- [CVE-2022-46166](https://cve.now/CVE-2022-46166.md): Spring Boot Admins integrated notifier support allows arbitrary code execution (CVSS 8.1, codecentric spring-boot-admin · de.codecentric:spring-boot-…)
- [CVE-2022-31690](https://cve.now/CVE-2022-31690.md): Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege esc (CVSS 8.1, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2022-22979](https://cve.now/CVE-2022-22979.md): In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functional (no CVSS, Spring Cloud Function · org.springframework.cloud:spring-cl…)
- [CVE-2022-22976](https://cve.now/CVE-2022-22976.md): Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerabil (no CVSS, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2022-22978](https://cve.now/CVE-2022-22978.md): In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigure (no CVSS, Spring Security · org.springframework.security:spring-se… +1)
- [CVE-2022-22971](https://cve.now/CVE-2022-22971.md): In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vu (no CVSS, Spring Framework · org.springframework:spring-messaging)
- [CVE-2022-22970](https://cve.now/CVE-2022-22970.md): In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable t (no CVSS, Spring Framework · org.springframework:spring-beans)
- [CVE-2022-22969](https://cve.now/CVE-2022-22969.md): \<Issue Description\> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Servic (no CVSS, Spring Security OAuth · org.springframework.security.oauth:…)
- [CVE-2022-22968](https://cve.now/CVE-2022-22968.md): In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBind (no CVSS, Spring Framework · org.springframework:spring-context)
- [CVE-2022-22950](https://cve.now/CVE-2022-22950.md): n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL exp (no CVSS, Spring Framework · org.springframework:spring-expression)
- [CVE-2022-22965](https://cve.now/CVE-2022-22965.md): A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. (CVSS 9.8, KEV, Spring Framework · org.springframework:spring-beans +4)
- [CVE-2022-22963](https://cve.now/CVE-2022-22963.md): In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to (CVSS 9.8, KEV, Spring Cloud Function · org.springframework.cloud:spring-cl…)
- [CVE-2022-27772](https://cve.now/CVE-2022-27772.md): spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. (no CVSS, org.springframework.boot:spring-boot)
- [CVE-2022-22946](https://cve.now/CVE-2022-22946.md): In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates (no CVSS, Spring Cloud Gateway)
- [CVE-2022-22947](https://cve.now/CVE-2022-22947.md): In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuat (CVSS 10.0, KEV, Spring Cloud Gateway · org.springframework.cloud:spring-clo…)
- [CVE-2021-22060](https://cve.now/CVE-2021-22060.md): In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious (no CVSS, Spring Framework · org.springframework:spring-core)
- [CVE-2021-22053](https://cve.now/CVE-2021-22053.md): Applications using both \`spring-cloud-netflix-hystrix-dashboard\` and \`spring-boot-starter-thymeleaf\` expose a way to execute code submitted (no CVSS, Spring Cloud Netflix · org.springframework.cloud:spring-clo…)
- [CVE-2021-22051](https://cve.now/CVE-2021-22051.md): Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream servi (no CVSS, Spring Cloud Gateway · org.springframework.cloud:spring-clo…)
- [CVE-2021-22096](https://cve.now/CVE-2021-22096.md): In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious (no CVSS, Spring Framework · org.springframework:spring-core +1)
- [CVE-2021-22044](https://cve.now/CVE-2021-22044.md): In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level \`@Re (no CVSS, Spring Cloud OpenFeign · org.springframework.cloud:spring-c…)
- [CVE-2021-22119](https://cve.now/CVE-2021-22119.md): Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a De (no CVSS, Spring Security · org.springframework.security:spring-se… +1)
- [CVE-2021-22118](https://cve.now/CVE-2021-22118.md): In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege es (no CVSS, Spring Framework · org.springframework:spring-web)
- [CVE-2021-22112](https://cve.now/CVE-2021-22112.md): Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to (no CVSS, Spring Security · org.springframework.security:spring-se… +1)
- [CVE-2021-22113](https://cve.now/CVE-2021-22113.md): Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing (no CVSS, Spring Cloud Netflix Zuul · org.springframework.cloud:sprin…)
- [CVE-2020-5428](https://cve.now/CVE-2020-5428.md): Possibility of SQL Injection in Spring Cloud Task Execution Sorting Query (CVSS 5.1, Spring by VMware Spring Cloud Task · org.springframework.cl…)
- [CVE-2020-5427](https://cve.now/CVE-2020-5427.md): Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query (CVSS 5.7, Spring by VMware Spring Cloud Data Flow)
- [CVE-2021-21234](https://cve.now/CVE-2021-21234.md): Directory Traversal (CVSS 7.7, lukashinsch spring-boot-actuator-logview · eu.hinsch:spring…)
- [CVE-2020-5421](https://cve.now/CVE-2020-5421.md): RFD Protection Bypass via jsessionid (CVSS 8.7, Spring by VMware Spring Framework · org.springframework:spr…)
- [CVE-2020-5412](https://cve.now/CVE-2020-5412.md): Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard (no CVSS, Spring by VMware Spring Cloud Netflix · org.springframework…)
- [CVE-2020-5410](https://cve.now/CVE-2020-5410.md): Directory Traversal with spring-cloud-config-server (CVSS 7.5, KEV, Spring by VMware Spring Cloud Config · org.springframework.…)
- [CVE-2020-5408](https://cve.now/CVE-2020-5408.md): Dictionary attack with Spring Security queryable text encryptor (no CVSS, Spring by VMware Spring Security · org.springframework.secu…)
- [CVE-2020-5407](https://cve.now/CVE-2020-5407.md): Signature Wrapping Vulnerability with spring-security-saml2-service-provider (no CVSS, Spring by VMware Spring Security · org.springframework.secu…)
- [CVE-2020-5405](https://cve.now/CVE-2020-5405.md): Directory Traversal with spring-cloud-config-server (no CVSS, Spring by VMware Spring Cloud Config · org.springframework.…)
- [CVE-2020-5397](https://cve.now/CVE-2020-5397.md): CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux (CVSS 5.3, Spring Framework · org.springframework:spring-webmvc +1)
- [CVE-2020-5398](https://cve.now/CVE-2020-5398.md): RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application (CVSS 8.0, Spring Framework · org.springframework:spring-webmvc +1)
- [CVE-2013-6430](https://cve.now/CVE-2013-6430.md): The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properl (no CVSS, Pivotal Spring MVC · org.springframework:spring-web)
- [CVE-2016-1000027](https://cve.now/CVE-2016-1000027.md): Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untru (CVSS 9.8, org.springframework:spring-web)
- [CVE-2019-11272](https://cve.now/CVE-2019-11272.md): PlaintextPasswordEncoder authenticates encoded passwords that are null (no CVSS, Spring Security · org.springframework.security:spring-se… +1)
- [CVE-2019-11269](https://cve.now/CVE-2019-11269.md): Open Redirector in spring-security-oauth2 (CVSS 4.2, Spring Security OAuth · org.springframework.security.oauth:…)
- [CVE-2019-3799](https://cve.now/CVE-2019-3799.md): Directory Traversal with spring-cloud-config-server (no CVSS, Spring Cloud Config · org.springframework.cloud:spring-clou…)
- [CVE-2019-3797](https://cve.now/CVE-2019-3797.md): Additional information exposure with Spring Data JPA derived queries (CVSS 3.5, Spring Boot · org.springframework.data:spring-data-jpa)
- [CVE-2019-3795](https://cve.now/CVE-2019-3795.md): Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security (CVSS 3.8, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2019-3778](https://cve.now/CVE-2019-3778.md): Open Redirect in spring-security-oauth2 (no CVSS, Spring Security OAuth · org.springframework.security.oau… +1)
- [CVE-2018-15801](https://cve.now/CVE-2018-15801.md): Authorization Bypass During JWT Issuer Validation with spring-security (CVSS 3.3, Spring by Pivotal Spring Security · org.springframework.… +1)
- [CVE-2018-15756](https://cve.now/CVE-2018-15756.md): DoS Attack via Range Requests (CVSS 7.5, Pivotal Spring framework · org.springframework:spring-core)
- [CVE-2018-15758](https://cve.now/CVE-2018-15758.md): Privilege Escalation in spring-security-oauth2 (CVSS 9.6, Pivotal Spring Security OAuth · org.springframework.securit…)
- [CVE-2018-11039](https://cve.now/CVE-2018-11039.md): Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to c (no CVSS, Pivotal Spring Framework · org.springframework:spring-web)
- [CVE-2018-11040](https://cve.now/CVE-2018-11040.md): Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable (no CVSS, Pivotal Spring Framework · org.springframework:spring-core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/spring
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.