# cve.now: Spring

The newest entries naming Spring as an affected vendor (up to 200), of 247 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-59324](https://cve.now/CVE-2026-59324.md): fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction (CVSS 8.2)
- [CVE-2026-59322](https://cve.now/CVE-2026-59322.md): EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders (CVSS 6.3)
- [CVE-2026-59321](https://cve.now/CVE-2026-59321.md): Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check (CVSS 4.2)
- [CVE-2026-59320](https://cve.now/CVE-2026-59320.md): In Spring AMQP the link credit never replenished on listener exception path (CVSS 6.5)
- [CVE-2026-59319](https://cve.now/CVE-2026-59319.md): RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure (CVSS 4.3)
- [CVE-2026-59317](https://cve.now/CVE-2026-59317.md): In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop (CVSS 6.5)
- [CVE-2026-59316](https://cve.now/CVE-2026-59316.md): Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) (CVSS 8.2)
- [CVE-2026-59315](https://cve.now/CVE-2026-59315.md): Spring Cloud Config Monitor Denial of Service (CVSS 5.3)
- [CVE-2026-59314](https://cve.now/CVE-2026-59314.md): Spring Framework response splitting in ContentDisposition (CVSS 3.7)
- [CVE-2026-59311](https://cve.now/CVE-2026-59311.md): Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation (CVSS 6.8)
- [CVE-2026-59306](https://cve.now/CVE-2026-59306.md): Potential for deserialization of untrusted types in Spring Cloud Stream (CVSS 3.1)
- [CVE-2026-59313](https://cve.now/CVE-2026-59313.md): Server Sent Event stream corruption in Spring MVC functional web framework (CVSS 9.8)
- [CVE-2026-59307](https://cve.now/CVE-2026-59307.md): Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference (CVSS 8.0)
- [CVE-2026-59305](https://cve.now/CVE-2026-59305.md): Partition interceptor may be improperly added while sending message (CVSS 3.1)
- [CVE-2026-59304](https://cve.now/CVE-2026-59304.md): Improper caching of the original content type in Spring Cloud Stream Avro (CVSS 3.1)
- [CVE-2026-59303](https://cve.now/CVE-2026-59303.md): Dynamic destination cache size is not properly bound in Spring Cloud Stream (CVSS 3.1)
- [CVE-2026-59302](https://cve.now/CVE-2026-59302.md): Potential for logging sensitive data in Spring Cloud Stream (CVSS 3.1)
- [CVE-2026-59301](https://cve.now/CVE-2026-59301.md): Potential for logging sensitive data in Spring Cloud Function Azure (CVSS 3.1)
- [CVE-2026-59300](https://cve.now/CVE-2026-59300.md): Potential for logging sensitive data in Spring Cloud Function AWS (CVSS 3.1)
- [CVE-2026-59299](https://cve.now/CVE-2026-59299.md): Composition lookup can potentially poison base function in Spring Cloud Function (CVSS 3.1)
- [CVE-2026-59298](https://cve.now/CVE-2026-59298.md): Potential for improper filtering of HTTP headers in Spring Cloud Function (CVSS 3.1)
- [CVE-2026-59297](https://cve.now/CVE-2026-59297.md): Spring Cloud Function can incorrectly determine if URI is secure (CVSS 3.1)
- [CVE-2026-59294](https://cve.now/CVE-2026-59294.md): Arbitrary File Write via Path Traversal in ResourceCacheService (CVSS 5.9)
- [CVE-2026-59293](https://cve.now/CVE-2026-59293.md): SMB minimum protocol dialect defaults to SMB1 (CVSS 6.6)
- [CVE-2026-59292](https://cve.now/CVE-2026-59292.md): World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions) (CVSS 3.2)
- [CVE-2026-59291](https://cve.now/CVE-2026-59291.md): Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function (CVSS 2.0)
- [CVE-2026-59289](https://cve.now/CVE-2026-59289.md): Spring for GraphQL Denial of Service via pagination support (CVSS 7.5)
- [CVE-2026-59288](https://cve.now/CVE-2026-59288.md): Spring for GraphQL Information Exposure in GraphiQL support (CVSS 7.5)
- [CVE-2026-59287](https://cve.now/CVE-2026-59287.md): Spring for GraphQL WebSocket Client Denial of Service (CVSS 5.9)
- [CVE-2026-59286](https://cve.now/CVE-2026-59286.md): Spring for GraphQL loads Untrusted Resources in GraphiQL support (CVSS 8.1)
- [CVE-2026-59285](https://cve.now/CVE-2026-59285.md): Spring for GraphQL Unsafe Deserialization in pagination support (CVSS 8.1)
- [CVE-2026-59284](https://cve.now/CVE-2026-59284.md): Spring Cloud Commons no allow list for writable env actuator endpoint (CVSS 6.6)
- [CVE-2026-59283](https://cve.now/CVE-2026-59283.md): Spring Framework Safety Guard Bypass via SpEL Expression Compilation (CVSS 9.1)
- [CVE-2026-59282](https://cve.now/CVE-2026-59282.md): Spring Framework Denial of Service via Unbounded List Growth in Data Binding (CVSS 7.5)
- [CVE-2026-59281](https://cve.now/CVE-2026-59281.md): Spring Framework Cross-site Scripting via EscapedErrors (CVSS 6.1)
- [CVE-2026-59277](https://cve.now/CVE-2026-59277.md): Spring Security InetAddressMatchers Incomplete Internal Network Classification (CVSS 3.7)
- [CVE-2026-59276](https://cve.now/CVE-2026-59276.md): Timing Attack via Non-Constant-Time Comparison of Sensitive Values (CVSS 5.9)
- [CVE-2026-59280](https://cve.now/CVE-2026-59280.md): Spring Framework Path Traversal via Backslash in SpringTemplateLoader (CVSS 4.3)
- [CVE-2026-59272](https://cve.now/CVE-2026-59272.md): Log4j2 AmqpAppender disables TLS hostname verification by default (CVSS 6.8)
- [CVE-2026-47893](https://cve.now/CVE-2026-47893.md): Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService (CVSS 7.5)
- [CVE-2026-47892](https://cve.now/CVE-2026-47892.md): Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints (CVSS 9.8)
- [CVE-2026-47891](https://cve.now/CVE-2026-47891.md): Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder (CVSS 9.8)
- [CVE-2026-47890](https://cve.now/CVE-2026-47890.md): Spring Framework Server Sent Event stream corruption while rendering fragments (CVSS 9.8)
- [CVE-2026-47889](https://cve.now/CVE-2026-47889.md): Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse (CVSS 7.5)
- [CVE-2026-47888](https://cve.now/CVE-2026-47888.md): Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler (CVSS 7.5)
- [CVE-2026-47887](https://cve.now/CVE-2026-47887.md): Spring Framework Open Redirect in UrlFileNameViewController (CVSS 6.1)
- [CVE-2026-47886](https://cve.now/CVE-2026-47886.md): Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions (CVSS 7.5)
- [CVE-2026-47885](https://cve.now/CVE-2026-47885.md): Spring Framework maxPartSize Ignored in PartEventHttpMessageReader (CVSS 7.5)
- [CVE-2026-47884](https://cve.now/CVE-2026-47884.md): Spring Framework Improper Path Limitation in XsltView (CVSS 9.8)
- [CVE-2026-47883](https://cve.now/CVE-2026-47883.md): Spring Framework Open Redirect in UrlHandlerFilter (CVSS 6.1)
- [CVE-2026-59278](https://cve.now/CVE-2026-59278.md): In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages (CVSS 6.5)
- [CVE-2026-59275](https://cve.now/CVE-2026-59275.md): Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99) (CVSS 6.6)
- [CVE-2026-59274](https://cve.now/CVE-2026-59274.md): Unbounded decompression in UnZipTransformer enables zip-bomb DoS (CVSS 6.5)
- [CVE-2026-59271](https://cve.now/CVE-2026-59271.md): Admin password disclosed in BrokerNotAliveException message (CVSS 5.3)
- [CVE-2026-59270](https://cve.now/CVE-2026-59270.md): Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces (CVSS 9.4)
- [CVE-2026-47894](https://cve.now/CVE-2026-47894.md): Spring Cloud Config Server Native Environment Repository Exposure (CVSS 4.9)
- [CVE-2026-47881](https://cve.now/CVE-2026-47881.md): Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File (CVSS 5.9)
- [CVE-2026-47880](https://cve.now/CVE-2026-47880.md): DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names (CVSS 5.4)
- [CVE-2026-47879](https://cve.now/CVE-2026-47879.md): Spring Cloud Gateway SSRF and native file access with gRPC (CVSS 7.7)
- [CVE-2026-47878](https://cve.now/CVE-2026-47878.md): Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist (CVSS 5.6)
- [CVE-2026-47877](https://cve.now/CVE-2026-47877.md): Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) (CVSS 8.2)
- [CVE-2026-47875](https://cve.now/CVE-2026-47875.md): JobParameterDeserializer bypasses the trusted-type allowlist (CVSS 5.6)
- [CVE-2026-47864](https://cve.now/CVE-2026-47864.md): Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution (CVSS 6.4)
- [CVE-2026-47849](https://cve.now/CVE-2026-47849.md): Spring Data REST allows mutation of identifier and version properties via JSON Patch (CVSS 7.1)
- [CVE-2026-47874](https://cve.now/CVE-2026-47874.md): Reactor Netty HTTP Server Denial of Service With Pipelined Requests (CVSS 5.3)
- [CVE-2026-47861](https://cve.now/CVE-2026-47861.md): UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false (CVSS 6.3)
- [CVE-2026-47863](https://cve.now/CVE-2026-47863.md): Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush (CVSS 5.9)
- [CVE-2026-47862](https://cve.now/CVE-2026-47862.md): ZipTransformer uses file\_name header to build workDirectory path without sanitization (CVSS 5.4)
- [CVE-2026-47860](https://cve.now/CVE-2026-47860.md): Unbounded decompression of attacker-supplied compressed message bodies (CVSS 6.5)
- [CVE-2026-47859](https://cve.now/CVE-2026-47859.md): Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS (CVSS 5.4)
- [CVE-2026-47857](https://cve.now/CVE-2026-47857.md): Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around (CVSS 5.9)
- [CVE-2026-47856](https://cve.now/CVE-2026-47856.md): JsonToObjectTransformer resolves the json\_\_TypeId\_\_ message header to an arbitrary class without an allow-list (CVSS 6.3)
- [CVE-2026-47852](https://cve.now/CVE-2026-47852.md): Predictable cache directory location allows local ONNX model substitution in Spring AI (CVSS 7.5)
- [CVE-2026-47851](https://cve.now/CVE-2026-47851.md): Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader (CVSS 7.5)
- [CVE-2026-47850](https://cve.now/CVE-2026-47850.md): Spring Data REST allows mutation of the version property of immutable aggregates via PUT (CVSS 4.3)
- [CVE-2026-47845](https://cve.now/CVE-2026-47845.md): Reactor Netty HTTP Server may incorrectly evaluate proxy addresses (CVSS 5.3)
- [CVE-2026-47848](https://cve.now/CVE-2026-47848.md): Reactor Netty WebSocket Client Leaks Credentials On Redirect (CVSS 6.1)
- [CVE-2026-47844](https://cve.now/CVE-2026-47844.md): Reactor Netty HTTP Server Leaks Exception Details (CVSS 5.3)
- [CVE-2026-47843](https://cve.now/CVE-2026-47843.md): Reactor Netty may incorrectly route traffic due to DNS resolver reuse (CVSS 3.7)
- [CVE-2026-47842](https://cve.now/CVE-2026-47842.md): Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation (CVSS 6.5)
- [CVE-2026-47834](https://cve.now/CVE-2026-47834.md): Spring Data JPA Sort expression validation bypass (CVSS 4.8)
- [CVE-2026-47841](https://cve.now/CVE-2026-47841.md): WebAuthn User Verification Bypass via Session Serialization (CVSS 7.4)
- [CVE-2026-47837](https://cve.now/CVE-2026-47837.md): Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests (CVSS 6.8)
- [CVE-2026-47836](https://cve.now/CVE-2026-47836.md): Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN (CVSS 7.2)
- [CVE-2026-41707](https://cve.now/CVE-2026-41707.md): Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay (CVSS 7.4)
- [CVE-2026-59295](https://cve.now/CVE-2026-59295.md): Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability (CVSS 5.9)
- [CVE-2026-59318](https://cve.now/CVE-2026-59318.md): DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection (CVSS 6.5)
- [CVE-2026-59308](https://cve.now/CVE-2026-59308.md): Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation (CVSS 4.2)
- [CVE-2026-59279](https://cve.now/CVE-2026-59279.md): Unbounded persistent session allocation via repeated initialize requests (CVSS 7.5)
- [CVE-2026-59296](https://cve.now/CVE-2026-59296.md): Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability (CVSS 5.9)
- [CVE-2026-59323](https://cve.now/CVE-2026-59323.md): Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability (CVSS 5.3)
- [CVE-2026-59326](https://cve.now/CVE-2026-59326.md): HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server (CVSS 3.3)
- [CVE-2026-59328](https://cve.now/CVE-2026-59328.md): Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips (CVSS 4.2)
- [CVE-2026-59327](https://cve.now/CVE-2026-59327.md): Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations (CVSS 4.4)
- [CVE-2026-47882](https://cve.now/CVE-2026-47882.md): Spring Boot DevTools remote secret generated with a non-cryptographic PRNG (CVSS 8.3)
- [CVE-2026-47873](https://cve.now/CVE-2026-47873.md): Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces (CVSS 8.0)
- [CVE-2026-47858](https://cve.now/CVE-2026-47858.md): live information startup mode is vulnerable for remote code execution (CVSS 8.0)
- [CVE-2026-41862](https://cve.now/CVE-2026-41862.md): Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts witho (CVSS 8.8)
- [CVE-2026-47825](https://cve.now/CVE-2026-47825.md): Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations (CVSS 8.6)
- [CVE-2026-41708](https://cve.now/CVE-2026-41708.md): Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability (CVSS 7.5)
- [CVE-2026-47835](https://cve.now/CVE-2026-47835.md): Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores (CVSS 8.6)
- [CVE-2026-41856](https://cve.now/CVE-2026-41856.md): Spring GraphQL Annotation Detection Vulnerability (CVSS 7.5)
- [CVE-2026-41700](https://cve.now/CVE-2026-41700.md): Cross-Site WebSocket Hijacking in Spring for GraphQL (CVSS 8.1)
- [CVE-2026-41699](https://cve.now/CVE-2026-41699.md): Unsafe Deserialization in Spring GraphQL (CVSS 8.1)
- [CVE-2026-41001](https://cve.now/CVE-2026-41001.md): Predictable Temp Directory in Artemis Auto-configuration (CVSS 5.3)
- [CVE-2026-41000](https://cve.now/CVE-2026-41000.md): WSS4J validation does not use configured replay cache (CVSS 3.7)
- [CVE-2026-40999](https://cve.now/CVE-2026-40999.md): Spring WS SSRF via unvalidated WS-Addressing reply destinations (CVSS 8.6)
- [CVE-2026-40998](https://cve.now/CVE-2026-40998.md): Jaxp13 XPath XXE via StreamSource and SAXSource (CVSS 8.2)
- [CVE-2026-40997](https://cve.now/CVE-2026-40997.md): SOAP security faults leak Spring Security account state (CVSS 5.3)
- [CVE-2026-40996](https://cve.now/CVE-2026-40996.md): Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default (CVSS 4.8)
- [CVE-2026-40995](https://cve.now/CVE-2026-40995.md): X.509 authentication bypasses Spring Security account checks (CVSS 5.4)
- [CVE-2026-40994](https://cve.now/CVE-2026-40994.md): Wss4jSecurityInterceptor disables WS-I BSP validation by default (CVSS 8.2)
- [CVE-2026-40992](https://cve.now/CVE-2026-40992.md): Mail Auto-Configuration Does Not Enable SSL Hostname Verification (CVSS 5.0)
- [CVE-2026-40987](https://cve.now/CVE-2026-40987.md): Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization (CVSS 7.1)
- [CVE-2026-40986](https://cve.now/CVE-2026-40986.md): Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML (CVSS 4.8)
- [CVE-2026-40985](https://cve.now/CVE-2026-40985.md): Data Binding Vulnerability in Spring Web Flow with Unified EL Parser (CVSS 6.4)
- [CVE-2026-47838](https://cve.now/CVE-2026-47838.md): Unauthorized User Impersonation when Using X.509 Client Certificates (CVSS 6.8)
- [CVE-2026-41837](https://cve.now/CVE-2026-41837.md): Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys (CVSS 5.3)
- [CVE-2026-41732](https://cve.now/CVE-2026-41732.md): In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization (CVSS 8.1)
- [CVE-2026-41731](https://cve.now/CVE-2026-41731.md): In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization (CVSS 8.1)
- [CVE-2026-41730](https://cve.now/CVE-2026-41730.md): Spring Data REST exposes persistence-layer internals in error responses (CVSS 5.3)
- [CVE-2026-41729](https://cve.now/CVE-2026-41729.md): Spring Data REST SpEL Injection via Map Key in JSON Patch (CVSS 8.1)
- [CVE-2026-41728](https://cve.now/CVE-2026-41728.md): Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections (CVSS 7.5)
- [CVE-2026-41727](https://cve.now/CVE-2026-41727.md): In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior (CVSS 6.5)
- [CVE-2026-41726](https://cve.now/CVE-2026-41726.md): In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header (CVSS 6.5)
- [CVE-2026-41721](https://cve.now/CVE-2026-41721.md): Spring Data Commons Denial of Service via Data Binding (CVSS 5.9)
- [CVE-2026-41719](https://cve.now/CVE-2026-41719.md): Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator (CVSS 6.4)
- [CVE-2026-41717](https://cve.now/CVE-2026-41717.md): Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding (CVSS 8.1)
- [CVE-2026-41716](https://cve.now/CVE-2026-41716.md): Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names (CVSS 7.5)
- [CVE-2026-41714](https://cve.now/CVE-2026-41714.md): In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager (CVSS 4.0)
- [CVE-2026-41711](https://cve.now/CVE-2026-41711.md): Potential Denial of Service through crafted Sort Parameters (CVSS 5.9)
- [CVE-2026-41706](https://cve.now/CVE-2026-41706.md): Open Redirect When Using CookieRequestCache (CVSS 6.1)
- [CVE-2026-41701](https://cve.now/CVE-2026-41701.md): In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues (CVSS 4.4)
- [CVE-2026-41697](https://cve.now/CVE-2026-41697.md): Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern (CVSS 4.8)
- [CVE-2026-41696](https://cve.now/CVE-2026-41696.md): Spring Data MongoDB Bind Parameter Literal Quoting Breakout (CVSS 5.9)
- [CVE-2026-41695](https://cve.now/CVE-2026-41695.md): Denial of Service in Spring Data Commons Property Path Resolution (CVSS 7.5)
- [CVE-2026-41694](https://cve.now/CVE-2026-41694.md): SAML Payloads Decrypted Without Valid Signature (CVSS 3.7)
- [CVE-2026-41008](https://cve.now/CVE-2026-41008.md): Spring Security Authorization Server Open Redirect via request\_uri (CVSS 6.1)
- [CVE-2026-41003](https://cve.now/CVE-2026-41003.md): Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting (CVSS 7.6)
- [CVE-2026-40993](https://cve.now/CVE-2026-40993.md): Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry (CVSS 7.3)
- [CVE-2026-40991](https://cve.now/CVE-2026-40991.md): XML External Entity (XXE) injection when documenting untrusted XML content (CVSS 5.9)
- [CVE-2026-40988](https://cve.now/CVE-2026-40988.md): Unbounded DEFLATE Inflation in SAML 2.0 Service Provider (CVSS 7.5)
- [CVE-2026-41007](https://cve.now/CVE-2026-41007.md): Spring HATEOAS heap exhaustion through unbounded internal caching (CVSS 7.5)
- [CVE-2026-41006](https://cve.now/CVE-2026-41006.md): Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration (CVSS 7.5)
- [CVE-2026-41855](https://cve.now/CVE-2026-41855.md): Spring Framework Unsafe Deserialization via Jackson JMS Converters (CVSS 8.1)
- [CVE-2026-41854](https://cve.now/CVE-2026-41854.md): Spring Framework Server-Side Request Forgery via UriComponentsBuilder (CVSS 4.2)
- [CVE-2026-41853](https://cve.now/CVE-2026-41853.md): Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux (CVSS 5.3)
- [CVE-2026-41852](https://cve.now/CVE-2026-41852.md): Spring Framework Arbitrary Method Invocation in SpEL Expressions (CVSS 3.7)
- [CVE-2026-41851](https://cve.now/CVE-2026-41851.md): Spring Framework Denial of Service via Unbounded Cache in SpEL (CVSS 5.3)
- [CVE-2026-41850](https://cve.now/CVE-2026-41850.md): Spring Framework Algorithmic Denial of Service via SpEL Expressions (CVSS 7.5)
- [CVE-2026-41849](https://cve.now/CVE-2026-41849.md): Spring Framework Denial of Service via Integer Overflow in SpEL Expressions (CVSS 7.5)
- [CVE-2026-41848](https://cve.now/CVE-2026-41848.md): Spring Framework Denial of Service via AntPathMatcher (CVSS 3.7)
- [CVE-2026-41847](https://cve.now/CVE-2026-41847.md): Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL (CVSS 4.8)
- [CVE-2026-41846](https://cve.now/CVE-2026-41846.md): Spring Framework Cross-site Scripting via JSP Form Tags (CVSS 5.9)
- [CVE-2026-41845](https://cve.now/CVE-2026-41845.md): Spring Framework Cross-site Scripting via JavaScriptUtils (CVSS 7.1)
- [CVE-2026-41844](https://cve.now/CVE-2026-41844.md): Spring Framework Open Redirect in Spring MVC and WebFlux (CVSS 4.2)
- [CVE-2026-41843](https://cve.now/CVE-2026-41843.md): Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux (CVSS 5.9)
- [CVE-2026-41842](https://cve.now/CVE-2026-41842.md): Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux (CVSS 7.5)
- [CVE-2026-41841](https://cve.now/CVE-2026-41841.md): Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux (CVSS 5.9)
- [CVE-2026-41840](https://cve.now/CVE-2026-41840.md): Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. (CVSS 5.9)
- [CVE-2026-41839](https://cve.now/CVE-2026-41839.md): Spring Framework Escalation via Session Fixation in WebFlux (CVSS 4.2)
- [CVE-2026-41838](https://cve.now/CVE-2026-41838.md): Spring Framework Predictable Session ID in WebSocket Module (CVSS 4.8)
- [CVE-2026-41720](https://cve.now/CVE-2026-41720.md): Authentication Bypass with Empty Password in Spring LDAP (CVSS 7.4)
- [CVE-2026-41715](https://cve.now/CVE-2026-41715.md): Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect (CVSS 6.1)
- [CVE-2026-41710](https://cve.now/CVE-2026-41710.md): Cache Exhaustion in Stateful Retries leads to Denial of Service (CVSS 5.9)
- [CVE-2026-40984](https://cve.now/CVE-2026-40984.md): Micrometer HTTP server instrumentations DoS vulnerability (CVSS 7.5)
- [CVE-2026-40983](https://cve.now/CVE-2026-40983.md): Micrometer gRPC server instrumentation DoS vulnerability (CVSS 7.5)
- [CVE-2026-40990](https://cve.now/CVE-2026-40990.md): Unbounded cache for function definitions (CVSS 5.7)
- [CVE-2026-40989](https://cve.now/CVE-2026-40989.md): Self Routing guard bypassed via function composition (CVSS 5.7)
- [CVE-2026-41863](https://cve.now/CVE-2026-41863.md): LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API (CVSS 6.5)
- [CVE-2026-41705](https://cve.now/CVE-2026-41705.md): Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. (CVSS 8.6)
- [CVE-2026-40981](https://cve.now/CVE-2026-40981.md): When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentia (CVSS 7.5)
- [CVE-2026-41002](https://cve.now/CVE-2026-41002.md): The base directory (\`spring.cloud.config.server.git.basedir\`) used by the Spring Cloud Config Server to clone Git repositories to is suscept (CVSS 7.4)
- [CVE-2026-41004](https://cve.now/CVE-2026-41004.md): When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. (CVSS 4.4)
- [CVE-2026-40982](https://cve.now/CVE-2026-40982.md): Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. (CVSS 9.1)
- [CVE-2026-40969](https://cve.now/CVE-2026-40969.md): Spring gRPC AuthenticationException message reflected to remote client (CVSS 3.7)
- [CVE-2026-40968](https://cve.now/CVE-2026-40968.md): Spring gRPC SecurityContext leaks across requests on authorization failure (CVSS 4.3)
- [CVE-2026-40980](https://cve.now/CVE-2026-40980.md): In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by \`ForkPDFLay (CVSS 6.5)
- [CVE-2026-40979](https://cve.now/CVE-2026-40979.md): In Spring AI, having access to a shared environment can expose the ONNX model used by the application. (CVSS 6.1)
- [CVE-2026-40978](https://cve.now/CVE-2026-40978.md): SQL injection vulnerability in Spring AI's \`CosmosDBVectorStore\` allows attackers to execute arbitrary SQL queries via crafted document IDs. (CVSS 8.8)
- [CVE-2026-40967](https://cve.now/CVE-2026-40967.md): In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector stor (CVSS 8.6)
- [CVE-2026-40977](https://cve.now/CVE-2026-40977.md): When an application is configured to use \`ApplicationPidFileWriter\`, a local attacker with write access to the PID file's location can corru (CVSS 4.7)
- [CVE-2026-40976](https://cve.now/CVE-2026-40976.md): In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. (CVSS 9.1)
- [CVE-2026-40975](https://cve.now/CVE-2026-40975.md): Values produced by ${random.value} are not suitable for use as secrets. (CVSS 4.8)
- [CVE-2026-40974](https://cve.now/CVE-2026-40974.md): Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. (CVSS 5.0)
- [CVE-2026-40973](https://cve.now/CVE-2026-40973.md): A local attacker on the same host as the application may be able to take control of the directory used by \`ApplicationTemp\`. (CVSS 7.0)
- [CVE-2026-40972](https://cve.now/CVE-2026-40972.md): An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote se (CVSS 7.5)
- [CVE-2026-40971](https://cve.now/CVE-2026-40971.md): When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to th (CVSS 5.0)
- [CVE-2026-40970](https://cve.now/CVE-2026-40970.md): When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting (CVSS 5.0)
- [CVE-2026-22754](https://cve.now/CVE-2026-22754.md): ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules (CVSS 7.5)
- [CVE-2026-22753](https://cve.now/CVE-2026-22753.md): Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers (CVSS 7.5)
- [CVE-2026-22748](https://cve.now/CVE-2026-22748.md): Potential Security Misconfiguration when Using withIssuerLocation (CVSS 5.3)
- [CVE-2026-22747](https://cve.now/CVE-2026-22747.md): Unauthorized User Impersonation when Using X.509 Client Certificates (CVSS 6.8)
- [CVE-2026-22746](https://cve.now/CVE-2026-22746.md): User Attribute Enumeration when Using DaoAuthenticationProvider (CVSS 3.7)
- [CVE-2026-22751](https://cve.now/CVE-2026-22751.md): Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions (CVSS 4.8)
- [CVE-2026-22744](https://cve.now/CVE-2026-22744.md): In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, strin (CVSS 7.5)
- [CVE-2026-22743](https://cve.now/CVE-2026-22743.md): Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore (CVSS 7.5)
- [CVE-2026-22742](https://cve.now/CVE-2026-22742.md): Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching (CVSS 8.6)
- [CVE-2026-22738](https://cve.now/CVE-2026-22738.md): SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution (CVSS 9.8)
- [CVE-2026-22739](https://cve.now/CVE-2026-22739.md): Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks (CVSS 8.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/spring
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.