This Week in Spring - July 7th, 2026

This Week in Spring - July 7th, 2026 Hi, Spring fans! Welcome to another installment of This Week in Spring! We've got a lot to cover and I've got a plane to catch so let's go! What's that over on Spring Initializr? It's JobRunr, that's what! My favorite distributed job execution engine has...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0), org.webjars.npm:github-com-showdownjs-ng-showdown (1.1.0) +3 more potentially affected by CVE-2026-59711 via org.webjars.npm:showdown (>=1.9.1, <=2.1.0)

org.webjars.npm:showdown MAVEN version =1.9.1, =2.0.0, =1.0.2, =1.0.3 - org.webjars.npm:showdown-prism 0.2.0 Source cves: CVE-2026-59711 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17874449...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 2.7 Vulnerability Details CVEID:CVE-2016-1000027 DESCRIPTION: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution RCE issue if used for Java deserialization of untrusted data...

CVE-2026-41716

A flaw was found in Spring Data Commons. An attacker can exploit this vulnerability by sending repeated requests with specially crafted strings, which are then permanently retained in the internal property-lookup cache. This can lead to heap exhaustion, resulting in a Denial of Service DoS for th...

CVE-2026-41695

A flaw was found in Spring Data Commons. A remote attacker can exploit this vulnerability by providing specially crafted property path strings to the MappingContext property path resolution. This can lead to resource exhaustion, resulting in a denial of service DoS for affected applications...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.19.0, <=4.20.0)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49042 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17822332...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.17.0, <=4.18.2) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.17.0, <=4.18.2)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.17.0, =4.17.0, =4.18.2 Source cves: CVE-2026-49042 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17822332...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the filter process. An attacker can bypass intended security restrictions by supplying specially crafted argument headers that are not properly validated...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.19.0, <=4.20.0)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49042 Source advisory: OSV:GHSA-HH8R-75R6-QRG9...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.17.0, <=4.18.2) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.17.0, <=4.18.2)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.17.0, =4.17.0, =4.18.2 Source cves: CVE-2026-49042 Source advisory: OSV:GHSA-HH8R-75R6-QRG9...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.17.0, <=4.18.2) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.17.0, <=4.18.2)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.17.0, =4.17.0, =4.18.2 Source cves: CVE-2026-49042 Source advisory: GHSA-HH8R-75R6-QRG9...

org.apache.camel.springboot:camel-spring-ai-tools-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-49042 via org.apache.camel:camel-spring-ai-tools (>=4.19.0, <=4.20.0)

org.apache.camel:camel-spring-ai-tools MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49042 Source advisory: GHSA-HH8R-75R6-QRG9...

org.apache.camel.quarkus:camel-quarkus-amqp (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-amqp-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-43866 via org.apache.camel:camel-amqp (>=4.19.0, <=4.20.0)

org.apache.camel:camel-amqp MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-43866 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17875275...

org.apache.camel.springboot:camel-cxf-rest-starter (>=4.19.0, <=4.20.0), org.apache.camel:camel-cxf-spring-rest (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.19.0, <=4.20.0)

org.apache.camel:camel-cxf-rest MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879243...

io.kaoto.forage:forage-cxf-starter (1.3), one.x1f.sip.foundation:sip-soap-starter (>=4.4.0, <=4.4.2) +3 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-spring-soap (>=4.15.0, <=4.18.2)

org.apache.camel:camel-cxf-spring-soap MAVEN version =4.15.0, =4.4.0, =4.18.1, =4.15.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879247...

de.ikor.sip.foundation:sip-integration-starter (>=3.2.0, <=3.6.2), de.ikor.sip.foundation:sip-soap-starter (>=3.2.0, <=3.6.2) +10 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-spring-soap (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cxf-spring-soap MAVEN version =4.0.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =5.0.0.cr1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =4.0.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879247...

io.kaoto.forage:forage-cxf-starter (1.5.0), org.apache.camel.springboot:camel-cxf-soap-starter (>=4.19.0, <=4.20.0) +1 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-spring-soap (>=4.19.0, <=4.20.0)

org.apache.camel:camel-cxf-spring-soap MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879247...

org.apache.camel.springboot:camel-cxf-rest-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-spring-rest (>=4.19.0, <=4.20.0)

org.apache.camel:camel-cxf-spring-rest MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879246...

org.apache.camel.karaf:camel-cxf-spring-all (>=4.7.0, <=4.14.7), org.apache.camel.springboot:camel-cxf-rest-starter (>=4.0.0, <=4.14.7) potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-spring-rest (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cxf-spring-rest MAVEN version =4.0.0, =4.7.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879246...

org.apache.camel.karaf:camel-cxf-spring-all (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-cxf-rest-starter (>=4.15.0, <=4.18.2) potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-spring-rest (>=4.15.0, <=4.18.2)

org.apache.camel:camel-cxf-spring-rest MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.2 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879246...