ROOT-APP-MAVEN-CVE-2026-47838 CVE-2026-47838 in io.root.org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2026-47838 in the io.root.org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22732 CVE-2026-22732 in io.root.org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2026-22732 in the io.root.org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38821 CVE-2024-38821 in io.root.org.springframework.security:spring-security-web - Patched by Root

Root has patched CVE-2024-38821 in the io.root.org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-22234 CVE-2024-22234 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2024-22234 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-22228 CVE-2025-22228 in io.root.org.springframework.security:spring-security-crypto - Patched by Root

Root has patched CVE-2025-22228 in the io.root.org.springframework.security:spring-security-crypto package for Root:Maven. Multiple fixed versions available...

CVE-2026-41710

A flaw was found in Spring Retry. A remote attacker can craft a large number of unique requests, leading to the exhaustion of the application-wide stateful retry cache. Once the cache is full, it permanently rejects further updates, causing all subsequent stateful retries and circuit breakers in...

CVE-2026-40990

A flaw was found in Spring Cloud Function. A local attacker with low privileges could exploit this vulnerability by repeatedly adding functions to the Function Registry, leading to an Out Of Memory OOM error. This resource exhaustion can cause a Denial of Service DoS for the affected application...

CVE-2026-41714

A flaw was found in Spring AMQP. Applications that configure their broker connection using RabbitConnectionFactoryBean.setUri"amqps://..." without explicitly enabling SSL via setUseSSLtrue may establish a TLS Transport Layer Security encrypted connection without proper certificate validation or...

CVE-2026-41701

A flaw was found in Spring AMQP. The system generates predictable correlation identifiers IDs for message replies due to an internal simple counter. This predictability could allow an attacker to potentially infer or manipulate message flows, leading to a low impact on the confidentiality and...

ROOT-APP-MAVEN-CVE-2024-22258 CVE-2024-22258 in io.root.org.springframework.security:spring-security-oauth2-authorization-server - Patched by Root

Root has patched CVE-2024-22258 in the io.root.org.springframework.security:spring-security-oauth2-authorization-server package for Root:Maven. Multiple fixed versions available...

cve-2026-47882 - LOW - CVE-2026-47882: Spring Boot DevTools remote secret generated with a non-cryptographic PRNG

When enabling Spring Boot DevTools support for a remote application target for example a Docker container or Cloud Foundry app from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret w...

cve-2026-59328 - MEDIUM - CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

cve-2026-59327 - MEDIUM - CVE-2026-59327: Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

cve-2026-59326 - LOW - CVE-2026-59326: HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server

The Spring Boot language server logs the raw value of the httpsproxy / HTTPSPROXY / httpproxy / HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth...

Spring Framework STOMP CSRF Vulnerability (CVE-2025-41254)

STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework:6.2.0 - 6.2.11, 6.1.0 - 6.1.23, 6.0.x - 6.0.29, 5.3.0 - 5.3.45, Older, unsupported versions are also affected...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC [CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC or WebFlux CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846. Spring MVC is used as part of our microservices. These vulnerabilities have been addressed. Please read the detail...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854. Spring Framework is used as part of our microservices. These vulnerabilities have been addressed. Please read the detai...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41850, CVE-2026-41851, CVE-2026-41852]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Spring Framework is used as part of our microservices. These vulnerabilities have been addressed. Please read the details for remediation below...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service (ReDoS) in Spring Framework [CVE-2026-41848]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service ReDoS in Spring Framework CVE-2026-41848. Spring Framework is used as part of our microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Data Commons [CVE-2026-41695, CVE-2026-41711, CVE-2026-41716, CVE-2026-41721 ]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Data Commons CVE-2026-41695, CVE-2026-41711, CVE-2026-41716, CVE-2026-41721 . Spring Data Commons is used in our microservices. These vulnerabilities have been addressed. Please read the details for remediatio...