CVE-2026-22745

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is serving static resources from...

CVE-2026-22745 CVE-2026-22745 : Denial of service in static resource handling on Windows platforms

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is serving static resources from...

CVE-2026-22741

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is configuring the resource chain support...

CVE-2026-22741 Static resource cache poisoning in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is configuring the resource chain support...

PT-2026-35908

Name of the Vulnerable Software and Affected Versions Spring MVC affected versions not specified Spring WebFlux affected versions not specified Description Applications using Spring MVC or Spring WebFlux are susceptible to cache poisoning during the resolution of static resources. This occurs whe...

CVE-2026-22741: Use of Cache Containing Sensitive Information

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is configuring the resource chain support...

CVE-2026-22745: Uncontrolled Resource Consumption

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is serving static resources from...

atomkraft (>=0.0.1, <=0.1.1), dialogy (>=0.9.21, <=2.2.1) +2 more potentially affected by CVE-2026-34726 via copier (6.2.0)

copier PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - atomkraft =0.0.1, =0.9.21, =0.18.0, =0.1.0, =0.3.9 Source cves: CVE-2026-34726 Source advisory: OSV:PYSEC-2026-2134...

atomkraft (>=0.0.1, <=0.1.1), dialogy (>=0.9.21, <=2.2.1) +2 more potentially affected by CVE-2026-34730 via copier (6.2.0)

copier PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - atomkraft =0.0.1, =0.9.21, =0.18.0, =0.1.0, =0.3.9 Source cves: CVE-2026-34730 Source advisory: OSV:PYSEC-2026-2135...

atomkraft (>=0.0.1, <=0.1.1), dialogy (>=0.9.21, <=2.2.1) +2 more potentially affected by CVE-2026-34730 via copier (6.2.0)

copier PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - atomkraft =0.0.1, =0.9.21, =0.18.0, =0.1.0, =0.3.9 Source cves: CVE-2026-34730 Source advisory: OSV:GHSA-HGJQ-P8CR-GG4H...

atomkraft (>=0.0.1, <=0.1.1), dialogy (>=0.9.21, <=2.2.1) +2 more potentially affected by CVE-2026-34726 via copier (6.2.0)

copier PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - atomkraft =0.0.1, =0.9.21, =0.18.0, =0.1.0, =0.3.9 Source cves: CVE-2026-34726 Source advisory: OSV:GHSA-85V3-4M8G-HRH6...

CVE-2026-22737

A flaw was found in Spring Framework. When Java scripting engine enabled template views such as those using JRuby or Jython are used in Spring MVC and Spring WebFlux applications, a remote attacker can exploit this to disclose sensitive content from files located outside the intended script...

CVE-2026-22735

A flaw was found in Spring MVC and WebFlux. A remote attacker with low privileges could exploit this vulnerability, requiring user interaction. This could lead to stream corruption, potentially affecting the integrity of data being transmitted. Mitigation Mitigation for this issue is either not...

EUVD-2026-13404

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE. This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46...

EUVD-2026-13406

Use of Java scripting engine enabled e.g. JRuby, Jython template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0...

GHSA-6HCQ-HMM3-JJ3C Spring MVC and WebFlux has Server Sent Event stream corruption

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE. This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46...

Spring MVC and WebFlux has Server Sent Event stream corruption

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE. This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46...

com.addc:addc-svr-mvc (>=2.6, <=2.9), com.addc:addc-web-mvc (>=2.6, <=2.9) +93 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.2.12.release)

org.springframework.security:spring-security-web MAVEN version 4.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.addc:addc-svr-mvc =2.6, =2.6, =2.6, =4.1.2, =4.1.2...

CVE-2026-22737: Improper Limitation of a Pathname to a Restricted Directory

Use of Java scripting engine enabled e.g. JRuby, Jython template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0...

CVE-2026-22735: Improper Locking

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE. This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46...