Security Bulletin: Vulnerability in Spring Framework affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Spring Framework has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

CVE-2026-41840

A flaw was found in Spring WebFlux applications. A remote attacker could exploit this vulnerability by sending specially crafted multipart requests, leading to a Denial of Service DoS condition. This could make the application unavailable to legitimate users. Mitigation No specific mitigation is...

CVE-2014-0225

CVE-2014-0225...

CVE-2026-41843

CVE-2026-41843...

CVE-2026-41844

CVE-2026-41844...

CVE-2026-41845

CVE-2026-41845...

CVE-2026-41848

CVE-2026-41848...

CVE-2026-41839

CVE-2026-41839...

CLSA-2026-1787317970 TuxCare security update for org.springframework (5 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 5 CVEs. Fixed in 5.3.31-tuxcare.11...

CLSA-2026-1787317539 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 6 CVEs. Fixed in 4.1.7.RELEASE-tuxcare.6...

CLSA-2026-1787313469 TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 7 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.3...

CLSA-2026-1787313161 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 2 CVEs. Fixed in 5.3.30-tuxcare.7...

CLSA-2026-1787311912 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 2 CVEs. Fixed in 4.3.30.RELEASE-tuxcare.7...

CLSA-2026-1787311640 TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 4 CVEs. Fixed in 5.3.24-tuxcare.6...

CLSA-2026-1787205684 TuxCare security update for org.springframework (14 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 14 CVEs. Fixed in 6.1.19-tuxcare.1...

cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler

cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler...

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse...

cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments

cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments...

cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader

cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader...

Cross-site Scripting (XSS)

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...