CLSA-2026-1778460303 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 77 org.springframework.boot packages to address 1 CVE. Fixed in 2.3.6.RELEASE-tuxcare.3...

CLSA-2026-1776299674 TuxCare security update for org.springframework.boot (2 CVEs)

TuxCare rebuilt 75 org.springframework.boot packages to address 2 CVEs. Fixed in 2.6.15-tuxcare.9...

CLSA-2026-1776040413 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 77 org.springframework.boot packages to address 1 CVE. Fixed in 2.3.6.RELEASE-tuxcare.2...

CLSA-2026-1774916753 TuxCare security update for org.springframework.boot (2 CVEs)

TuxCare rebuilt 77 org.springframework.boot packages to address 2 CVEs. Fixed in 2.3.6.RELEASE-tuxcare.1...

CLSA-2026-1770336547 TuxCare security update for org.springframework.boot (2 CVEs)

TuxCare rebuilt 78 org.springframework.boot packages to address 2 CVEs. Fixed in 3.1.8-tuxcare.1...

CLSA-2025-1764029254 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 76 org.springframework.boot packages to address 1 CVE. Fixed in 2.7.18-tuxcare.10...

CLSA-2025-1752019358 TuxCare security update for org.springframework.boot (5 CVEs)

TuxCare rebuilt 77 org.springframework.boot packages to address 5 CVEs. Fixed in 2.4.6.tuxcare.2...

CLSA-2025-1755561852 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 76 org.springframework.boot packages to address 1 CVE. Fixed in 2.7.18-tuxcare.8...

CLSA-2025-1754006610 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 75 org.springframework.boot packages to address 1 CVE. Fixed in 2.6.15.tuxcare.1...

CLSA-2025-1738627240 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 76 org.springframework.boot packages to address 1 CVE. Fixed in 2.7.18.tuxcare.4...

Exploit for Code Injection in Vmware Spring_Framework

PoC Spring4Shell CVE-2022-22965 Proof of Concept per lo sfr...

Exploit for CVE-2026-16723

CVE-2026-16723 Fastjson RCE ★ CVE-2026-16723 Fastjson @JSONT...

CLEANSTART-2026-QG73743 Security fixes in spring-boot 3.5.13-r0

Package spring-boot version 3.5.13-r0 fixes 1 vulnerabilities: ghsa-j288-q9x7-2f5v...

CLEANSTART-2026-RA47496 Security fixes in spring-boot 3.4.13-r0

Package spring-boot version 3.4.13-r0 fixes 2 vulnerabilities: ghsa-4265-ccf5-phj5, ghsa-4g9r-vxhx-9pgx...

CVE-2026-59326

The CVE describes a disclosure risk in the Spring Boot language server: when creating an outbound HTTP client, it logs the raw value of https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variables at INFO level if no http.proxy workspace setting is configured. Proxy URLs often contain Basi...

CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-59328 Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

CVE-2026-47858 live information startup mode is vulnerable for remote code execution

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Thei...

EUVD-2026-50970

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Thei...

A Bootiful Podcast: Spring Boot founder and lead Phil Webb

Hi, Spring fans! In this installment I talk to Spring Boot cofounder Phil Webb who joins the show to unpack the latest Spring Boot 4.1 release, from the long-awaited Spring gRPC support and MongoDB batch starter to security, observability, service connections, and other polished improvements...