Spring — Vulnerabilities & Security Advisories 247

Browse all 247 CVE security advisories affecting Spring. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Spring is a widely adopted Java framework designed for building enterprise-level applications, serving as the backbone for numerous critical web services. Its extensive ecosystem has historically exposed developers to diverse security risks, particularly Remote Code Execution (RCE) and Server-Side Request Forgery (SSRF), stemming from complex request handling and deserialization flaws. While Cross-Site Scripting (XSS) and privilege escalation issues also appear in the record, the most severe incidents involve critical RCE vulnerabilities that allow attackers to execute arbitrary code on affected servers. The framework’s modular nature means vulnerabilities in specific components, such as Spring Boot or Spring Security, can impact the entire application stack. With 72 recorded CVEs, maintaining strict dependency updates and adhering to secure coding practices are essential for mitigating these persistent threats in production environments.

Found 6 results / 247 Clear Filters

Top products by Spring: Spring Framework Spring Security Spring AI Spring Integration Spring Boot Spring Cloud Config Spring for GraphQL Spring Cloud Function Spring Web Services Spring AMQP Reactor Netty Spring For Apache Kafka Spring Data REST Spring Tools for Eclipse Spring Cloud Stream Spring Batch Spring Data Commons Micrometer Spring Spring HATEOAS Spring Cloud Gateway Spring Web Flow Spring Data MongoDB Reactor Core Spring gRPC Spring Data JPA Spring LDAP Spring Security OAuth Cloud Gateway Spring Cloud Commons

CVE ID	Title	CVSS	Severity	Published
CVE-2026-47849	Spring Data REST allows mutation of identifier and version properties via JSON Patch — Spring Data REST	7.1	High	2026-08-27
CVE-2026-47850	Spring Data REST allows mutation of the version property of immutable aggregates via PUT — Spring Data REST	4.3	Medium	2026-08-26
CVE-2026-41837	Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys — Spring Data REST CWE-284	5.3	Medium	2026-06-09
CVE-2026-41730	Spring Data REST exposes persistence-layer internals in error responses — Spring Data REST CWE-209	5.3	Medium	2026-06-09
CVE-2026-41729	Spring Data REST SpEL Injection via Map Key in JSON Patch — Spring Data REST CWE-917	8.1	High	2026-06-09
CVE-2026-41728	Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections — Spring Data REST CWE-284	7.5	High	2026-06-09

This page lists every published CVE security advisory associated with Spring. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.