Spring vulnerabilities
247 CVEs and advisories name Spring as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-22232Spring Cloud Config Server May Not Use Vault Token Sent By Clients
- CVE-2025-22223Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods.
- CVE-2025-22228CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length
- CVE-2024-38829Spring LDAP sensitive data exposure for case-sensitive comparisons
- CVE-2024-38828CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter
- CVE-2024-38821Authorization Bypass of Static Resources in WebFlux Applications
- CVE-2024-38816CVE-2024-38816: Path traversal vulnerability in functional web frameworks
- CVE-2024-38807CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader
- CVE-2024-38808CVE-2024-38808: Spring Expression DoS Vulnerability
- CVE-2024-38810Missing Authorization When Using @AuthorizeReturnObject
- CVE-2024-37084CVE-2024-37084: Remote code execution in Spring Cloud Data Flow
- CVE-2024-22262CVE-2024-22262: Spring Framework URL Parsing with Host Validation
- CVE-2024-22258CVE-2024-22258: PKCE Downgrade in Spring Authorization Server
- CVE-2024-22259CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)
- CVE-2024-22243CVE-2024-22243: Spring Framework URL Parsing with Host Validation
- CVE-2024-22234CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated
- CVE-2024-22236In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution i
- CVE-2024-22233CVE-2024-22233: Spring Framework server Web DoS Vulnerability
- CVE-2023-34055Spring Boot server Web Observations DoS Vulnerability
- CVE-2023-34054Reactor Netty HTTP Server Metrics DoS Vulnerability
- CVE-2023-34053Spring Framework server Web Observations DoS Vulnerability
- CVE-2023-34050Spring AMQP Deserialization Vulnerability
- CVE-2023-34047Exposure of data and identity to wrong session in Spring for GraphQL
- CVE-2023-34040Java Deserialization vulnerability in Spring-Kafka When Improperly Configured
- CVE-2023-34036Forwarded header exploit with Spring HATEOAS on WebFlux
- CVE-2020-5397CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux
- CVE-2020-5398RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
- CVE-2019-11272PlaintextPasswordEncoder authenticates encoded passwords that are null
- CVE-2019-11269Open Redirector in spring-security-oauth2
- CVE-2019-3802Additional information exposure with Spring Data JPA example matcher