Spring vulnerabilities
247 CVEs and advisories name Spring as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-41849Spring Framework Denial of Service via Integer Overflow in SpEL Expressions
- CVE-2026-41848Spring Framework Denial of Service via AntPathMatcher
- CVE-2026-41847Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL
- CVE-2026-41846Spring Framework Cross-site Scripting via JSP Form Tags
- CVE-2026-41845Spring Framework Cross-site Scripting via JavaScriptUtils
- CVE-2026-41844Spring Framework Open Redirect in Spring MVC and WebFlux
- CVE-2026-41843Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux
- CVE-2026-41842Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux
- CVE-2026-41841Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux
- CVE-2026-41840Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.
- CVE-2026-41839Spring Framework Escalation via Session Fixation in WebFlux
- CVE-2026-41838Spring Framework Predictable Session ID in WebSocket Module
- CVE-2026-41720Authentication Bypass with Empty Password in Spring LDAP
- CVE-2026-41715Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect
- CVE-2026-41710Cache Exhaustion in Stateful Retries leads to Denial of Service
- CVE-2026-40984Micrometer HTTP server instrumentations DoS vulnerability
- CVE-2026-40983Micrometer gRPC server instrumentation DoS vulnerability
- CVE-2026-40990Unbounded cache for function definitions
- CVE-2026-40989Self Routing guard bypassed via function composition
- CVE-2026-41863LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API
- CVE-2026-41705Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.
- CVE-2026-40981When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentia
- CVE-2026-41002The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is suscept
- CVE-2026-41004When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.
- CVE-2026-40982Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module.
- CVE-2026-40969Spring gRPC AuthenticationException message reflected to remote client
- CVE-2026-40968Spring gRPC SecurityContext leaks across requests on authorization failure
- CVE-2026-40980In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLay
- CVE-2026-40979In Spring AI, having access to a shared environment can expose the ONNX model used by the application.
- CVE-2026-40978SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs.