429 matches found
CLEANSTART-2026-GL50057 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1
Security vulnerability affects the rundeck package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...
Security Bulletin: Due to the use of Spring WebFlux, IBM Sterling Control Center is vulnerable to multiple CVEs (CVE-2026-47883, CVE-2026-47885, CVE-2026-47889, CVE-2026-47891 )
Summary Spring WebFlux is used by IBM Sterling Control Center and as part of dependency one of them is in spring-web-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47883 DESCRIPTION: UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The...
Security Bulletin: Vulnerability reported in jackson-core-2.18.6.jar for APIM 11.1 is now addressed
Summary Vulnerability reported in jackson-core-2.18.6.jar for APIM 11.1 is now addressed Vulnerability Details CVEID:CVE-2026-68494 DESCRIPTION: The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is...
ROOT-APP-MAVEN-CVE-2026-22740 CVE-2026-22740 in org.springframework:spring-webflux - Patched by Root
Root has patched CVE-2026-22740 in the org.springframework:spring-webflux package for Root:Maven. Multiple fixed versions available...
Security Bulletin: Vulnerabilities in Netty,jackson-databind,Angular,bootstrap,React Router,decode-uri-component,Reactor Netty,Spring WebFlux,Spring Framework,spring-web might affect IBM Storage Defender Copy Data Management
Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, jackson-databind, Angular, bootstrap, React Router, decode-uri-component, Reactor Netty, Spring WebFlux, Spring Framework,spring-web. Vulnerabilities include allowing the renamed JSON key to be assigned...
Security Bulletin: Vulnerabilities in netty-codec, spring-webflux, spring-data, Spring MVC, Immutable and ACE might affect IBM Storage Defender Copy Data Management
Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in netty-codec, spring-webflux, spring-data, Spring MVC, Immutable and ACE. Vulnerabilities include Netty can cause native memory exhaustion, An attacker can bypass the short-circuit mechanism by sending a reques...
CLEANSTART-2026-QW68592 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit
Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...
CLEANSTART-2026-TS74004 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason
Security vulnerability affects the apache-hive package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...
CLEANSTART-2026-CJ18873 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1
Security vulnerability affects the apache-hive package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...
PT-2026-108540
Security vulnerability affects the apache-hive package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...
PT-2026-108514
Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...
PT-2026-108368
Security vulnerability affects the apache-hive package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...
CVE-2026-47885
A flaw was found in Spring WebFlux. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. This oversight could allow a remote attacker to send excessively large multipart requests, potentially leading to resource exhaustion and ...
Sensitive Information Disclosure
org.springframework, spring-webflux is vulnerable to sensitive information disclosure. The vulnerability is due to request headers being included in the exception reason when handling WebSocket connections, which allows an attacker to potentially obtain indirectly sensitive user information by...
Resource Exhaustion
Spring WebFlux is vulnerable to Resource Exhaustion. The vulnerability is due to the PartEventHttpMessageReader not enforcing the maxPartSize limit when maxInMemorySize is set to -1, where an attacker can send arbitrarily large multipart requests that consume excessive memory and trigger a...
CVE-2026-47891
A flaw was found in Spring WebFlux applications that utilize the Aalto XML processor to parse XML input. A remote attacker could exploit this vulnerability by sending specially crafted XML, causing the application to bypass the maxInMemorySize limit. This can lead to excessive memory consumption,...
Linux Distros Unpatched Vulnerability : CVE-2026-47891
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework...
Linux Distros Unpatched Vulnerability : CVE-2026-47883
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both...
Linux Distros Unpatched Vulnerability : CVE-2026-47885
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring...
ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +2594 more potentially affected by CVE-2026-47892 via org.springframework:spring-webflux (>=6.2.0, <=6.2.19)
org.springframework:spring-webflux MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-47892 Source advisory: OSV:GHSA-9QF2-26P9-2Q2Q...