DEBIAN-CVE-2026-47886

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

UBUNTU-CVE-2026-47886

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

CVE-2026-47886

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

EUVD-2026-66854

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

CVE-2026-47886 Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

CVE-2026-47886

Applications evaluating user-supplied Spring Expression Language (SpEL) expressions are vulnerable to a Denial of Service (DoS) attack. The root cause is the use of the power operator (^) with BigDecimal or BigInteger operands and a large exponent value. Affected Spring Framework versions include...

CVE-2026-47886 Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

CVE-2026-47886

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

EUVD-2026-66824

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier...

PT-2026-82404

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Spring...

CVE-2026-47886: Uncontrolled Resource Consumption

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

CVE-2026-47863 Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier...

PT-2026-82352

Name of the Vulnerable Software and Affected Versions Reactor Core versions 3.8.0 through 3.8.6 Reactor Core versions 3.5.0 through 3.7.19 Reactor Core versions 3.4.41 and earlier Description Applications using the Flux.windowTimeout operator with fairBackpressure enabled are susceptible to a...

trivy-operator v0.34.0

Kubernetes-native security toolkit. Documentation Introduction The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues. The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernete...

GHSA-W67G-5RQW-F597 vulnerabilities

Vulnerabilities for packages: kubevela, aws-node-termination-handler, rancher-telemetry, cloudflared, rke2-runtime-fips, longhorn-engine, cluster-api, cosmo-router, virt-handler, gpu-operator-fips, redis-operator-fips, eks-distro-fips, virt-api-fips, amazon-cloudwatch-agent, jitsucom-bulker,...

GHSA-W67G-5RQW-F597 vulnerabilities

Vulnerabilities for packages: kubevela, guac, verticadb-operator, redis-operator, infinispan-operator, emissary, cloudflared, jitsucom-bulker, amazon-cloudwatch-agent, kubernetes, aws-node-termination-handler, juicefs-csi-driver, etcd, rancher-telemetry, op-geth...

Moderate: Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

The 1.3.7 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...

Important: Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

The 1.3.7 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...

Moderate: Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

The 1.3.7 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...

Moderate: Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

The 1.3.7 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...