Spring vulnerabilities
247 CVEs and advisories name Spring as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-59323Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability
- CVE-2026-59326HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server
- CVE-2026-59328Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
- CVE-2026-59327Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations
- CVE-2026-47882Spring Boot DevTools remote secret generated with a non-cryptographic PRNG
- CVE-2026-47873Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces
- CVE-2026-47858live information startup mode is vulnerable for remote code execution
- CVE-2026-41862Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts witho
- CVE-2026-47825Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations
- CVE-2026-41708Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability
- CVE-2026-47835Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
- CVE-2026-41856Spring GraphQL Annotation Detection Vulnerability
- CVE-2026-41700Cross-Site WebSocket Hijacking in Spring for GraphQL
- CVE-2026-41699Unsafe Deserialization in Spring GraphQL
- CVE-2026-41001Predictable Temp Directory in Artemis Auto-configuration
- CVE-2026-41000WSS4J validation does not use configured replay cache
- CVE-2026-40999Spring WS SSRF via unvalidated WS-Addressing reply destinations
- CVE-2026-40998Jaxp13 XPath XXE via StreamSource and SAXSource
- CVE-2026-40997SOAP security faults leak Spring Security account state
- CVE-2026-40996Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
- CVE-2026-40995X.509 authentication bypasses Spring Security account checks
- CVE-2026-40994Wss4jSecurityInterceptor disables WS-I BSP validation by default
- CVE-2026-40992Mail Auto-Configuration Does Not Enable SSL Hostname Verification
- CVE-2026-40987Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization
- CVE-2026-40986Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML
- CVE-2026-40985Data Binding Vulnerability in Spring Web Flow with Unified EL Parser
- CVE-2026-47838Unauthorized User Impersonation when Using X.509 Client Certificates
- CVE-2026-41837Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys
- CVE-2026-41732In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization
- CVE-2026-41731In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization