Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service. The vulnerability is due to stream corruption when Server-Sent Events SSE are used with functional web framework applications in Spring MVC...

CLSA-2026-1788813738 TuxCare security update for org.springframework (8 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 8 CVEs. Fixed in 5.0.13.RELEASE-tuxcare.5...

CLSA-2026-1788807216 TuxCare security update for org.springframework (11 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 11 CVEs. Fixed in 5.1.20.RELEASE-tuxcare.5...

CLSA-2026-1788804848 TuxCare security update for org.springframework (14 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 14 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.6...

CLSA-2026-1788800921 TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 5.3.29-tuxcare.10...

CLSA-2026-1788800102 TuxCare security update for org.springframework (8 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 8 CVEs. Fixed in 5.3.21-tuxcare.2...

Stream Corruption

Spring Framework is vulnerable to stream corruption. The vulnerability is due to improper handling of response streams when processing SSE with view fragments, which allows an attacker to potentially corrupt or disrupt the application’s HTTP response stream...

Open Redirect

Spring Framework is vulnerable to an open redirect. The vulnerability is due to insufficiently restrictive URL pattern matching, which allows an attacker to manipulate a URL and redirect a victim to an attacker-controlled external destination...

CLSA-2026-1788782570 TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 4 CVEs. Fixed in 4.2.9.RELEASE-tuxcare.11...

CLSA-2026-1788782067 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.16-tuxcare.5...

CLSA-2026-1788547257 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.0.11-tuxcare.4...

CLSA-2026-1788547255 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.16-tuxcare.4...

CLSA-2026-1788534182 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.0.12-tuxcare.4...

CLSA-2026-1788527138 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 2 CVEs. Fixed in 6.0.23-tuxcare.9...

CLSA-2026-1788526262 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.0.13-tuxcare.4...

CLSA-2026-1788525613 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.0.16-tuxcare.8...

CLSA-2026-1788525419 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 2 CVEs. Fixed in 6.0.0-tuxcare.3...

Improper Authorization

Spring Framework is vulnerable to Improper Authorization. The vulnerability is due to a header predicate bypass in pre-flight requests for WebFlux functional endpoints deployed with DispatcherServlet, allowing an attacker to bypass intended header-based restrictions...

Improper Security Configuration

Spring Framework is vulnerable to Improper Security Configuration. The vulnerability is due to response cookies being serialized without the SameSite attribute in WebFlux applications using the Jetty 12 Core reactive adapter...

Memory Leak

Spring Framework is vulnerable to a memory leak. The vulnerability is due to a malformed SETUP frame, where the RSocket server allocates resources without proper cleanup and an attacker can repeatedly send crafted frames to exhaust memory...