Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Spring — Vulnerabilities & Security Advisories 247

Browse all 247 CVE security advisories affecting Spring. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Spring is a widely adopted Java framework designed for building enterprise-level applications, serving as the backbone for numerous critical web services. Its extensive ecosystem has historically exposed developers to diverse security risks, particularly Remote Code Execution (RCE) and Server-Side Request Forgery (SSRF), stemming from complex request handling and deserialization flaws. While Cross-Site Scripting (XSS) and privilege escalation issues also appear in the record, the most severe incidents involve critical RCE vulnerabilities that allow attackers to execute arbitrary code on affected servers. The framework’s modular nature means vulnerabilities in specific components, such as Spring Boot or Spring Security, can impact the entire application stack. With 72 recorded CVEs, maintaining strict dependency updates and adhering to secure coding practices are essential for mitigating these persistent threats in production environments.

Top products by Spring: Spring Framework Spring Security Spring AI Spring Integration Spring Boot Spring Cloud Config Spring for GraphQL Spring Cloud Function Spring Web Services Spring AMQP Reactor Netty Spring For Apache Kafka Spring Data REST Spring Tools for Eclipse Spring Cloud Stream Spring Batch Spring Data Commons Micrometer Spring Spring HATEOAS Spring Cloud Gateway Spring Web Flow Spring Data MongoDB Reactor Core Spring gRPC Spring Data JPA Spring LDAP Spring Security OAuth Cloud Gateway Spring Cloud Commons
CVE ID Title CVSS Severity Published
CVE-2026-47878 Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist — Spring Batch 5.6 Medium 2026-08-27
CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist — Spring Batch 5.6 Medium 2026-08-27
CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution — Spring Integration 6.4 Medium 2026-08-27
CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch — Spring Data REST 7.1 High 2026-08-27
CVE-2026-47874 Reactor Netty HTTP Server Denial of Service With Pipelined Requests — Reactor Netty 5.3 Medium 2026-08-26
CVE-2026-47861 UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false — Spring Integration 6.3 Medium 2026-08-26
CVE-2026-47863 Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush — Reactor Core 5.9 Medium 2026-08-26
CVE-2026-47862 ZipTransformer uses file_name header to build workDirectory path without sanitization — Spring Integration 5.4 Medium 2026-08-26
CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies — Spring AMQP 6.5 Medium 2026-08-26
CVE-2026-47859 Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS — Spring Integration 5.4 Medium 2026-08-26
CVE-2026-47857 Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around — Reactor Core 5.9 Medium 2026-08-26
CVE-2026-47856 JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list — Spring Integration 6.3 Medium 2026-08-26
CVE-2026-47852 Predictable cache directory location allows local ONNX model substitution in Spring AI — Spring AI 7.5 High 2026-08-26
CVE-2026-47851 Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader — Spring AI 7.5 High 2026-08-26
CVE-2026-47850 Spring Data REST allows mutation of the version property of immutable aggregates via PUT — Spring Data REST 4.3 Medium 2026-08-26
CVE-2026-47845 Reactor Netty HTTP Server may incorrectly evaluate proxy addresses — Reactor Netty 5.3 Medium 2026-08-26
CVE-2026-47848 Reactor Netty WebSocket Client Leaks Credentials On Redirect — Reactor Netty 6.1 Medium 2026-08-26
CVE-2026-47844 Reactor Netty HTTP Server Leaks Exception Details — Reactor Netty 5.3 Medium 2026-08-26
CVE-2026-47843 Reactor Netty may incorrectly route traffic due to DNS resolver reuse — Reactor Netty 3.7 Low 2026-08-26
CVE-2026-47842 Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation — Spring Security 6.5 Medium 2026-08-26
CVE-2026-47834 Spring Data JPA Sort expression validation bypass — Spring Data JPA 4.8 Medium 2026-08-26
CVE-2026-47841 WebAuthn User Verification Bypass via Session Serialization — Spring Security 7.4 High 2026-08-26
CVE-2026-47837 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests — Spring Cloud Config CWE-306 6.8 Medium 2026-08-26
CVE-2026-47836 Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN — Spring Cloud Config 7.2 High 2026-08-26
CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay — Spring Security CWE-294 7.4 High 2026-08-25
CVE-2026-59295 Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability — Micrometer 5.9 Medium 2026-08-24
CVE-2026-59318 DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection — Spring AI CWE-863 6.5 Medium 2026-08-21
CVE-2026-59308 Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation — Spring AI CWE-668 4.2 Medium 2026-08-21
CVE-2026-59279 Unbounded persistent session allocation via repeated initialize requests — Spring AI CWE-770 7.5 High 2026-08-21
CVE-2026-59296 Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability — Micrometer 5.9 Medium 2026-08-21

This page lists every published CVE security advisory associated with Spring. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.