CLSA-2026-1787311912 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 2 CVEs. Fixed in 4.3.30.RELEASE-tuxcare.7...

CLSA-2026-1787311640 TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 4 CVEs. Fixed in 5.3.24-tuxcare.6...

Exploit for CVE-2026-16723

CVE-2026-16723 Fastjson RCE ★ CVE-2026-16723 Fastjson @JSONT...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through SpringTemplateLoader.getResource and resolve in the Spring MVC template-loading path. An attacker can read local files by supplying a file: or classpath: view name with a fragment suffix, which causes the...

PT-2026-79375

Name of the Vulnerable Software and Affected Versions Spring AI version 2.0.0 Description The MCP Streamable HTTP server transport, specifically the WebFlux and WebMvc variants, fails to limit the number of retained sessions and does not require client authentication by default. This allows a...

PT-2026-79377

Name of the Vulnerable Software and Affected Versions Spring AI version 2.0.0 Spring AI versions 1.1.0 through 1.1.8 Spring AI versions 1.0.0 through 1.0.9 Description In the tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced during...

CVE-2026-59318: Incorrect Authorization

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege...

CVE-2026-59308: Exposure of Resource to Wrong Sphere

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI: 2.0.0...

CVE-2026-59279: Allocation of Resources Without Limits or Throttling

The MCP Streamable HTTP server transport WebFlux and WebMvc variants does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over...

PT-2026-79376

Name of the Vulnerable Software and Affected Versions Spring AI version 2.0.0 Description In the Semantic Cache support of Spring AI, the context hash used to isolate cached responses between different system prompts may allow cached responses to be shared across unrelated contexts. Recommendatio...

CVE-2026-63490

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-bas...

CVE-2026-63490 Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-bas...

CVE-2026-63490 Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-bas...

CVE-2026-63490

CVE-2026-63490 is an arbitrary file read vulnerability in the handlebars-springmvc module of Handlebars.java (prior to 4.5.3). The SpringTemplateLoader resolves Spring MVC view names via Spring's ResourceLoader without path-containment validation. An attacker can craft a view name using a file: o...

CLSA-2026-1787205684 TuxCare security update for org.springframework (14 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 14 CVEs. Fixed in 6.1.19-tuxcare.1...

Sensitive Cookie in HTTPS Session Without "Secure" Attribute

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +12313 more potentially affected by CVE-2026-59282 via org.springframework:spring-beans (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-beans MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.1.1-beta, =1.1.1-beta, =1.1.1-beta, =1.1.1-beta, =1.3.0-beta and more Source cves: CVE-2026-59282 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267072...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +9572 more potentially affected by CVE-2026-47890 via org.springframework:spring-webmvc (>=6.2.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =6.2.0, =0.5.0, =0.1.2, =0.1.3, =0.1.0, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.29 and more Source cves: CVE-2026-47890 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267094...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +730 more potentially affected by CVE-2026-59292 via org.springframework.integration:spring-integration-core (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-core MAVEN version =7.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 -...

ch.sbb:spring-cloud-stream-binder-solace (>=9.1.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (4.1.0.1) +522 more potentially affected by CVE-2026-59292 via org.springframework.integration:spring-integration-core (7.1.0)

org.springframework.integration:spring-integration-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-core and may be impacted: - ch.sbb:spring-cloud-stream-binder-solace =9.1.0,...