2600 matches found
Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-22745 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an...
CLSA-2026-1789427454 TuxCare security update for org.springframework (18 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1...
CLSA-2026-1789416166 TuxCare security update for org.springframework (12 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 12 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.5...
CLSA-2026-1789380988 TuxCare security update for org.springframework (20 CVEs)
TuxCare rebuilt 23 org.springframework packages to address 20 CVEs. Fixed in 5.2.11.RELEASE-tuxcare.1...
CLSA-2026-1789377089 TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 23 org.springframework packages to address 4 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.5...
CLSA-2026-1789218209 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.21-tuxcare.13...
Cross-site Scripting (XSS)
Spring Framework is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper HTML escaping when rendering field errors obtained through the no-argument Errors.getFieldErrors or Errors.getFieldError accessors, which allows an attacker to inject arbitrary HTML or JavaScript code...
Directory Traversal
Spring Framework is vulnerable to Directory Traversal. The vulnerability is due to improper validation of untrusted view names when using SpringTemplateLoader for FreeMarker template resolution, which allows an attacker to manipulate the view name and access files outside the intended template...
Safety Guard Bypass
Spring Framework is vulnerable to a safety guard bypass. The vulnerability is due to improper enforcement of security restrictions during compiled SpEL expression evaluation, which allows an attacker to bypass the intended safety protections and execute expressions with capabilities that should...
HTTP Response Splitting
Spring Framework is vulnerable to HTTP response splitting. The vulnerability is due to building a Content-Disposition header value from untrusted input, where the input file name is used without proper sanitization and attackers can supply a malicious file name containing CRLF characters to split...
Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring
Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.3.25 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...
Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring
Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.2.31 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...
Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring
Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.5.19 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...
Denial Of Service (DoS)
Spring Framework is vulnerable to Denial Of Service DoS. The vulnerability is due to the Aalto XML processor not correctly enforcing the maxInMemorySize limit when parsing XML input, which allows an attacker to provide oversized XML data that consumes excessive memory and potentially causes a...
Open Redirect
Spring Framework is vulnerable to Open Redirect. The vulnerability is due to improper handling of URLs by UrlFileNameViewController when mapped with an end-of-path and no configured prefix, which allows an attacker to craft a malicious URL that redirects users to an attacker-controlled external...
CVE-2026-47892
A flaw was found in Spring Framework. This vulnerability allows a header predicate bypass to occur in a pre-flight request within a WebFlux application that uses functional endpoints and is deployed with DispatcherServlet. This bypass could potentially lead to unexpected behavior or security poli...
CLSA-2026-1788871245 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.31-tuxcare.14...
Denial Of Service (DoS)
Spring Framework is vulnerable to Denial of Service DoS. The vulnerability is due to inefficient processing of the SpEL power operator ^ with BigDecimal or BigInteger operands and large exponent values, which allows an attacker to supply a crafted expression that consumes excessive CPU and memory...