Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Spring — Vulnerabilities & Security Advisories 247

Browse all 247 CVE security advisories affecting Spring. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Spring is a widely adopted Java framework designed for building enterprise-level applications, serving as the backbone for numerous critical web services. Its extensive ecosystem has historically exposed developers to diverse security risks, particularly Remote Code Execution (RCE) and Server-Side Request Forgery (SSRF), stemming from complex request handling and deserialization flaws. While Cross-Site Scripting (XSS) and privilege escalation issues also appear in the record, the most severe incidents involve critical RCE vulnerabilities that allow attackers to execute arbitrary code on affected servers. The framework’s modular nature means vulnerabilities in specific components, such as Spring Boot or Spring Security, can impact the entire application stack. With 72 recorded CVEs, maintaining strict dependency updates and adhering to secure coding practices are essential for mitigating these persistent threats in production environments.

Found 29 results / 247 Clear Filters
Top products by Spring: Spring Framework Spring Security Spring AI Spring Integration Spring Boot Spring Cloud Config Spring for GraphQL Spring Cloud Function Spring Web Services Spring AMQP Reactor Netty Spring For Apache Kafka Spring Data REST Spring Tools for Eclipse Spring Cloud Stream Spring Batch Spring Data Commons Micrometer Spring Spring HATEOAS Spring Cloud Gateway Spring Web Flow Spring Data MongoDB Reactor Core Spring gRPC Spring Data JPA Spring LDAP Spring Security OAuth Cloud Gateway Spring Cloud Commons
CVE ID Title CVSS Severity Published
CVE-2026-59277 Spring Security InetAddressMatchers Incomplete Internal Network Classification — Spring Security 3.7 Low 2026-08-27
CVE-2026-59276 Timing Attack via Non-Constant-Time Comparison of Sensitive Values — Spring Security 5.9 Medium 2026-08-27
CVE-2026-59270 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces — Spring Security 9.4 Critical 2026-08-27
CVE-2026-47877 Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) — Spring Security 8.2 High 2026-08-27
CVE-2026-47842 Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation — Spring Security 6.5 Medium 2026-08-26
CVE-2026-47841 WebAuthn User Verification Bypass via Session Serialization — Spring Security 7.4 High 2026-08-26
CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay — Spring Security CWE-294 7.4 High 2026-08-25
CVE-2026-47838 Unauthorized User Impersonation when Using X.509 Client Certificates — Spring Security CWE-287 6.8 Medium 2026-06-09
CVE-2026-41706 Open Redirect When Using CookieRequestCache — Spring Security CWE-601 6.1 Medium 2026-06-09
CVE-2026-41694 SAML Payloads Decrypted Without Valid Signature — Spring Security CWE-347 3.7 Low 2026-06-09
CVE-2026-41008 Spring Security Authorization Server Open Redirect via request_uri — Spring Security CWE-601 6.1 Medium 2026-06-09
CVE-2026-41003 Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting — Spring Security CWE-79 7.6 High 2026-06-09
CVE-2026-40993 Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry — Spring Security CWE-502 7.3 High 2026-06-09
CVE-2026-40988 Unbounded DEFLATE Inflation in SAML 2.0 Service Provider — Spring Security CWE-400 7.5 High 2026-06-09
CVE-2026-22754 ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules — Spring Security 7.5 High 2026-04-22
CVE-2026-22753 Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers — Spring Security 7.5 High 2026-04-22
CVE-2026-22748 Potential Security Misconfiguration when Using withIssuerLocation — Spring Security 5.3 Medium 2026-04-22
CVE-2026-22747 Unauthorized User Impersonation when Using X.509 Client Certificates — Spring Security 6.8 Medium 2026-04-22
CVE-2026-22746 User Attribute Enumeration when Using DaoAuthenticationProvider — Spring Security 3.7 Low 2026-04-22
CVE-2026-22751 Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions — Spring Security 4.8 Medium 2026-04-21
CVE-2026-22733 Authentication Bypass under Actuator CloudFoundry endpoints — Spring Security CWE-288 8.2 High 2026-03-19
CVE-2025-22234 Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation — Spring Security CWE-208 5.3 Medium 2026-01-22
CVE-2025-41232 CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods — Spring Security 9.1 Critical 2025-05-21
CVE-2025-22223 VMware Spring Security 安全漏洞 — Spring Security CWE-290 5.3 Medium 2025-03-24
CVE-2025-22228 CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length — Spring Security 7.4 High 2025-03-20
CVE-2024-38810 Missing Authorization When Using @AuthorizeReturnObject — spring security CWE-287 6.5 Medium 2024-08-20
CVE-2024-22234 CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated — Spring Security 7.4 High 2024-02-20
CVE-2019-11272 PlaintextPasswordEncoder authenticates encoded passwords that are null — Spring Security CWE-287 7.7 - 2019-06-26
CVE-2019-3795 Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security — Spring Security CWE-330 6.5 - 2019-04-09

This page lists every published CVE security advisory associated with Spring. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.