CLSA-2026-1788201541 TuxCare security update for org.springframework (17 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 17 CVEs. Fixed in 6.2.19-tuxcare.1...

Linux Distros Unpatched Vulnerability : CVE-2026-47892

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

Linux Distros Unpatched Vulnerability : CVE-2026-47885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring...

Linux Distros Unpatched Vulnerability : CVE-2026-47884

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an / mapping that results in view rendering, and where the...

Linux Distros Unpatched Vulnerability : CVE-2026-59281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument...

Linux Distros Unpatched Vulnerability : CVE-2026-59280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from...

Linux Distros Unpatched Vulnerability : CVE-2026-47888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring...

Linux Distros Unpatched Vulnerability : CVE-2026-47893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception...

Linux Distros Unpatched Vulnerability : CVE-2026-47886

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator...

Linux Distros Unpatched Vulnerability : CVE-2026-59282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a...

Linux Distros Unpatched Vulnerability : CVE-2026-59313

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8...

Linux Distros Unpatched Vulnerability : CVE-2026-47889

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8...

Linux Distros Unpatched Vulnerability : CVE-2026-47891

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework...

Linux Distros Unpatched Vulnerability : CVE-2026-47883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both...

Linux Distros Unpatched Vulnerability : CVE-2026-47890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8...

Linux Distros Unpatched Vulnerability : CVE-2026-47887

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open...

Linux Distros Unpatched Vulnerability : CVE-2026-59283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL...

Linux Distros Unpatched Vulnerability : CVE-2026-59314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.6.0.6)

The version of AOS installed on the remote host is prior to 7.6.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.6.0.6 advisory. - In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and...

Security Bulletin: Vulnerabilities in spring-core-5.3.25.jar and spring-expression-6.1.11.jar (CVE-2026-41850, CVE-2026-41851, CVE-2026-41852, CVE-2026-41848) affect IBM PowerVM Novalink.

Summary The spring-core-5.3.25.jar and spring-expression-6.1.11.jar are used by IBM PowerVM Novalink. IBM PowerVM Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS atta...