Spring — Vulnerabilities & Security Advisories 247

Browse all 247 CVE security advisories affecting Spring. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Spring is a widely adopted Java framework designed for building enterprise-level applications, serving as the backbone for numerous critical web services. Its extensive ecosystem has historically exposed developers to diverse security risks, particularly Remote Code Execution (RCE) and Server-Side Request Forgery (SSRF), stemming from complex request handling and deserialization flaws. While Cross-Site Scripting (XSS) and privilege escalation issues also appear in the record, the most severe incidents involve critical RCE vulnerabilities that allow attackers to execute arbitrary code on affected servers. The framework’s modular nature means vulnerabilities in specific components, such as Spring Boot or Spring Security, can impact the entire application stack. With 72 recorded CVEs, maintaining strict dependency updates and adhering to secure coding practices are essential for mitigating these persistent threats in production environments.

Found 6 results / 247 Clear Filters

Top products by Spring: Spring Framework Spring Security Spring AI Spring Integration Spring Boot Spring Cloud Config Spring for GraphQL Spring Cloud Function Spring Web Services Spring AMQP Reactor Netty Spring For Apache Kafka Spring Data REST Spring Tools for Eclipse Spring Cloud Stream Spring Batch Spring Data Commons Micrometer Spring Spring HATEOAS Spring Cloud Gateway Spring Web Flow Spring Data MongoDB Reactor Core Spring gRPC Spring Data JPA Spring LDAP Spring Security OAuth Cloud Gateway Spring Cloud Commons

CVE ID	Title	CVSS	Severity	Published
CVE-2026-59326	HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server — Spring Tools for Eclipse	3.3	Low	2026-07-30
CVE-2026-59328	Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips — Spring Tools for Eclipse	4.2	Medium	2026-07-30
CVE-2026-59327	Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations — Spring Tools for Eclipse	4.4	Medium	2026-07-30
CVE-2026-47882	Spring Boot DevTools remote secret generated with a non-cryptographic PRNG — Spring Tools for Eclipse	8.3	High	2026-07-30
CVE-2026-47873	Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces — Spring Tools for Eclipse	8.0	High	2026-07-30
CVE-2026-47858	live information startup mode is vulnerable for remote code execution — Spring Tools for Eclipse	8.0	High	2026-07-30

This page lists every published CVE security advisory associated with Spring. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.