Spring vulnerabilities
247 CVEs and advisories name Spring as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-40967In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector stor
- CVE-2026-40977When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corru
- CVE-2026-40976In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints.
- CVE-2026-40975Values produced by ${random.value} are not suitable for use as secrets.
- CVE-2026-40974Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.
- CVE-2026-40973A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`.
- CVE-2026-40972An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote se
- CVE-2026-40971When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to th
- CVE-2026-40970When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting
- CVE-2026-22754ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules
- CVE-2026-22753Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers
- CVE-2026-22748Potential Security Misconfiguration when Using withIssuerLocation
- CVE-2026-22747Unauthorized User Impersonation when Using X.509 Client Certificates
- CVE-2026-22746User Attribute Enumeration when Using DaoAuthenticationProvider
- CVE-2026-22751Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions
- CVE-2026-22744In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, strin
- CVE-2026-22743Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore
- CVE-2026-22742Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching
- CVE-2026-22738SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution
- CVE-2026-22739Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
- CVE-2026-22737Spring Framework Improper Path Limitation with Script View Templates
- CVE-2026-22735Server Sent Event stream corruption
- CVE-2026-22733Authentication Bypass under Actuator CloudFoundry endpoints
- CVE-2026-22731Authentication Bypass under Actuator Health groups paths
- CVE-2025-22234Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation
- CVE-2026-22718Command injection vulnerability
- CVE-2025-41243Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux
- CVE-2025-41232CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods
- CVE-2025-22233Spring Framework DataBinder Case Sensitive Match Exception
- CVE-2025-22235Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed