Spring vulnerabilities
247 CVEs and advisories name Spring as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-47877Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
- CVE-2026-47875JobParameterDeserializer bypasses the trusted-type allowlist
- CVE-2026-47864Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
- CVE-2026-47849Spring Data REST allows mutation of identifier and version properties via JSON Patch
- CVE-2026-47874Reactor Netty HTTP Server Denial of Service With Pipelined Requests
- CVE-2026-47861UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false
- CVE-2026-47863Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush
- CVE-2026-47862ZipTransformer uses file_name header to build workDirectory path without sanitization
- CVE-2026-47860Unbounded decompression of attacker-supplied compressed message bodies
- CVE-2026-47859Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
- CVE-2026-47857Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
- CVE-2026-47856JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list
- CVE-2026-47852Predictable cache directory location allows local ONNX model substitution in Spring AI
- CVE-2026-47851Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
- CVE-2026-47850Spring Data REST allows mutation of the version property of immutable aggregates via PUT
- CVE-2026-47845Reactor Netty HTTP Server may incorrectly evaluate proxy addresses
- CVE-2026-47848Reactor Netty WebSocket Client Leaks Credentials On Redirect
- CVE-2026-47844Reactor Netty HTTP Server Leaks Exception Details
- CVE-2026-47843Reactor Netty may incorrectly route traffic due to DNS resolver reuse
- CVE-2026-47842Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation
- CVE-2026-47834Spring Data JPA Sort expression validation bypass
- CVE-2026-47841WebAuthn User Verification Bypass via Session Serialization
- CVE-2026-47837Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
- CVE-2026-47836Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
- CVE-2026-41707Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
- CVE-2026-59295Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability
- CVE-2026-59318DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection
- CVE-2026-59308Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation
- CVE-2026-59279Unbounded persistent session allocation via repeated initialize requests
- CVE-2026-59296Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability