Spring vulnerabilities
247 CVEs and advisories name Spring as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-59285Spring for GraphQL Unsafe Deserialization in pagination support
- CVE-2026-59284Spring Cloud Commons no allow list for writable env actuator endpoint
- CVE-2026-59283Spring Framework Safety Guard Bypass via SpEL Expression Compilation
- CVE-2026-59282Spring Framework Denial of Service via Unbounded List Growth in Data Binding
- CVE-2026-59281Spring Framework Cross-site Scripting via EscapedErrors
- CVE-2026-59277Spring Security InetAddressMatchers Incomplete Internal Network Classification
- CVE-2026-59276Timing Attack via Non-Constant-Time Comparison of Sensitive Values
- CVE-2026-59280Spring Framework Path Traversal via Backslash in SpringTemplateLoader
- CVE-2026-59272Log4j2 AmqpAppender disables TLS hostname verification by default
- CVE-2026-47893Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
- CVE-2026-47892Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
- CVE-2026-47891Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
- CVE-2026-47890Spring Framework Server Sent Event stream corruption while rendering fragments
- CVE-2026-47889Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
- CVE-2026-47888Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
- CVE-2026-47887Spring Framework Open Redirect in UrlFileNameViewController
- CVE-2026-47886Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions
- CVE-2026-47885Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
- CVE-2026-47884Spring Framework Improper Path Limitation in XsltView
- CVE-2026-47883Spring Framework Open Redirect in UrlHandlerFilter
- CVE-2026-59278In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages
- CVE-2026-59275Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)
- CVE-2026-59274Unbounded decompression in UnZipTransformer enables zip-bomb DoS
- CVE-2026-59271Admin password disclosed in BrokerNotAliveException message
- CVE-2026-59270Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
- CVE-2026-47894Spring Cloud Config Server Native Environment Repository Exposure
- CVE-2026-47881Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
- CVE-2026-47880DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names
- CVE-2026-47879Spring Cloud Gateway SSRF and native file access with gRPC
- CVE-2026-47878Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist