CVEs we hold for Spring
Records whose assigning authority named Spring as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-59328Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency TooltipsSpring Tools for Eclipse
CVE-2026-59327Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch ConfigurationsSpring Tools for Eclipse
CVE-2026-59326HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language ServerSpring Tools for VSCode / Cursor / Theia
CVE-2026-59324fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunctionSpring Integration
CVE-2026-59323Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerabilitySpring Micrometer Tracing
CVE-2026-59322EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeadersSpring Integration
CVE-2026-59321Shared JSR-223 ScriptEngine evaluated concurrently without THREADING checkSpring Integration
CVE-2026-59320In Spring AMQP the link credit never replenished on listener exception pathSpring AMQP
CVE-2026-59319RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data ExposureSpring AI
CVE-2026-59318DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt InjectionSpring AI
CVE-2026-59317In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service…Spring for Apache Kafka
CVE-2026-59316Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)Spring Authorization Server
CVE-2026-59313Server Sent Event stream corruption in Spring MVC functional web frameworkSpring Framework
CVE-2026-59311Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creationSpring Integration
CVE-2026-59307Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale referenceSpring Integration
CVE-2026-59306Potential for deserialization of untrusted types in Spring Cloud StreamSpring Cloud Stream
CVE-2026-59305Partition interceptor may be improperly added while sending messageSpring Cloud Stream
CVE-2026-59304Improper caching of the original content type in Spring Cloud Stream AvroSpring Cloud Stream
CVE-2026-59303Dynamic destination cache size is not properly bound in Spring Cloud StreamSpring Cloud Stream
CVE-2026-59301Potential for logging sensitive data in Spring Cloud Function AzureSpring Cloud Function
CVE-2026-59300Potential for logging sensitive data in Spring Cloud Function AWSSpring Cloud Function
CVE-2026-59299Composition lookup can potentially poison base function in Spring Cloud FunctionSpring Cloud Function
CVE-2026-59298Potential for improper filtering of HTTP headers in Spring Cloud FunctionSpring Cloud Function
CVE-2026-59296Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerabilitySpring Micrometer
CVE-2026-59295Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerabilitySpring Micrometer
CVE-2026-59292World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)Spring Integration
CVE-2026-59291Potential arbitrary file read and SSRF vulnerability in Spring Cloud FunctionSpring Cloud Function
CVE-2026-59284Spring Cloud Commons no allow list for writable env actuator endpointSpring Cloud Commons
CVE-2026-59282Spring Framework Denial of Service via Unbounded List Growth in Data BindingSpring Framework
CVE-2026-59278In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default…Spring for Apache Kafka
CVE-2026-59277Spring Security InetAddressMatchers Incomplete Internal Network ClassificationSpring Security
CVE-2026-59275Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default…Spring AMQP
CVE-2026-59270Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfacesSpring Security
CVE-2026-47893Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketServiceSpring Framework
CVE-2026-47892Spring Framework Header Predicate Bypass in WebFlux Functional EndpointsSpring Framework
CVE-2026-47890Spring Framework Server Sent Event stream corruption while rendering fragmentsSpring Framework
CVE-2026-47889Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponseSpring Framework
CVE-2026-47886Spring Framework Denial of Service via Unbounded Exponentiation in SpEL ExpressionsSpring Framework
CVE-2026-47882Spring Boot DevTools remote secret generated with a non-cryptographic PRNGSpring Tools for Eclipse
CVE-2026-47881Denial of Service in Spring Batch FlatFileItemReader via Malformed Input FileSpring Batch
CVE-2026-47880DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant namesSpring Integration
CVE-2026-47878Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlistSpring Batch
CVE-2026-47877Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)Spring Security
CVE-2026-47874Reactor Netty HTTP Server Denial of Service With Pipelined RequestsSpring Reactor Netty
CVE-2026-47873Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfacesSpring Tools for Eclipse
CVE-2026-47864Unsafe Java deserialization in SerializingHttpMessageConverter — remote code executionSpring Integration
CVE-2026-47863Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active…Spring Reactor Core
CVE-2026-47862ZipTransformer uses file_name header to build workDirectory path without sanitizationSpring Integration
CVE-2026-47861UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=falseSpring Integration
CVE-2026-47859Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoSSpring Integration
CVE-2026-47858live information startup mode is vulnerable for remote code executionSpring Tools for VSCode / Cursor / Theia
CVE-2026-47857Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-aroundSpring Reactor Core
CVE-2026-47856JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-listSpring Integration
CVE-2026-47852Predictable cache directory location allows local ONNX model substitution in Spring AISpring AI
CVE-2026-47851Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document ReaderSpring AI
CVE-2026-47850Spring Data REST allows mutation of the version property of immutable aggregates via PUTSpring Data REST
CVE-2026-47849Spring Data REST allows mutation of identifier and version properties via JSON PatchSpring Data REST
CVE-2026-47845Reactor Netty HTTP Server may incorrectly evaluate proxy addressesSpring Reactor Netty
CVE-2026-47843Reactor Netty may incorrectly route traffic due to DNS resolver reuseSpring Reactor Netty
CVE-2026-47842Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext CorrelationSpring Security
CVE-2026-47837Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook RequestsSpring Cloud Config
CVE-2026-47836Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVNSpring Cloud Config
CVE-2026-47835Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector…Spring AI
CVE-2026-47825Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situationsSpring Cloud Gateway
CVE-2026-41863LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills APISpring AI
CVE-2026-41853Spring Framework Multipart Request Smuggling in Spring MVC and WebFluxSpring Framework
CVE-2026-41849Spring Framework Denial of Service via Integer Overflow in SpEL ExpressionsSpring Framework
CVE-2026-41843Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFluxSpring Framework
CVE-2026-41842Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFluxSpring Framework
CVE-2026-41841Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFluxSpring Framework
CVE-2026-41837Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keysSpring Data REST
CVE-2026-41732In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to…Spring for Apache Pulsar
CVE-2026-41731In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to…Spring for Apache Kafka
CVE-2026-41730Spring Data REST exposes persistence-layer internals in error responsesSpring Data REST
CVE-2026-41728Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collectionsSpring Data REST
CVE-2026-41727In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behaviorSpring for Apache Kafka
CVE-2026-41726In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector headerSpring for Apache Kafka
CVE-2026-41719Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparatorSpring Data Redis
CVE-2026-41717Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter BindingSpring Data MongoDB
CVE-2026-41716Spring Data web support unbounded negative-result cache keyed on attacker-supplied property namesSpring Data Commons
CVE-2026-41715Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade RedirectSpring Reactor Netty
CVE-2026-41714In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses…Spring AMQP
CVE-2026-41707Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof ReplaySpring Security
CVE-2026-41701In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queuesSpring AMQP
CVE-2026-41697Spring Data Relational Parameter not Escaped for Query By Example LIKE PatternSpring Data R2DBC
CVE-2026-41008Spring Security Authorization Server Open Redirect via request_uriSpring Authorization Server
CVE-2026-41006Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configurationSpring HATEOAS
CVE-2026-41003Unencoded HTML Outputs in Spring Security May Allow Cross-Site ScriptingSpring Security
CVE-2026-40996Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by defaultSpring Web Services
CVE-2026-40993Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database EntrySpring Security
CVE-2026-40991XML External Entity (XXE) injection when documenting untrusted XML contentSpring REST Docs
CVE-2026-40987Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without…Spring Integration
CVE-2026-22754ervlet Path Not Correctly Included in Path Matching of XML Authorization RulesSpring Security
CVE-2026-22753Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchersSpring Security
CVE-2026-22752Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client…Spring Authorization Server
CVE-2026-22751Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessionsSpring Security
200 records, read from the index as it stood on 18 Oct 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.