Denial of Service (DoS)

Overview org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds. Affected versions of this package are vulnerable to Denial of Service DoS via data binding. An attacker can exhaust system memory resources by...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +662 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (>=3.0.0, <=3.3.15)

org.springframework.kafka:spring-kafka MAVEN version =3.0.0, =cloud-0.1, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.1.0, =0.1.0, =0.1.0, =3.6.0, =1.0.0, =2.2.1, =6.10.0 and more Source cves: CVE-2026-41726 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKKAFKA-17279506...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the DelegatingDeserializer function. An attacker can exhaust system memory by sending records with unique, random spring.kafka.serialization.selector header values, leading to...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +174 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (>=4.0.0-m2, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0-m2, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

be.dnsbelgium:rdap-server (1.1.0), co.paralleluniverse:comsat-spring-boot-security (0.4.0) +64 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.0.1.release)

org.springframework.security:spring-security-web MAVEN version 4.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - be.dnsbelgium:rdap-server 1.1.0 -...

be.dnsbelgium:rdap-server (>=0.3.3, <=1.0.3), com.github.yongjacky:jee.borneo.miri (1.1.6) +82 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.1.4.release)

org.springframework.security:spring-security-web MAVEN version 3.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - be.dnsbelgium:rdap-server =0.3.3, =1.6-2, =1.6.0, =1.6....

at.aimon.ops:aimon-ops-api (>=0.0.1, <=0.0.2), au.com.versent.jenkins.plugins:ignore-committer-strategy (>=55.v51410e712e0c, <=63.v7e87d06b_a_30c) +2284 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (>=6.4.0, <=6.4.13)

org.springframework.security:spring-security-web MAVEN version =6.4.0, =0.0.1, =55.v51410e712e0c, =1.0.1, =1.0.2, =1.0.4, =1.0.2, =1.0.16, =1.0.2, =1.0.4, =1.0.18 - cc.zzzyu.nacos:nacos-ai 3.1.1 - cc.zzzyu.nacos:nacos-cmdb 3.1.1 - cc.zzzyu.nacos:nacos-config 3.1.1 - cc.zzzyu.nacos:nacos-console...

com.github.waffle.demo:waffle-spring-filter (2.3.0), com.github.waffle.demo:waffle-spring-form (2.3.0) +41 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.2.17.release)

org.springframework.security:spring-security-web MAVEN version 4.2.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.github.waffle.demo:waffle-spring-filter 2.3.0 -...

com.github.lrkwz:urlmanaged-locale (0.0.1), com.revolsys.open:com.revolsys.open.orm (>=2012.07.30.release, <=2012.11.01.release) +30 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.0.7.release)

org.springframework.security:spring-security-web MAVEN version 3.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.github.lrkwz:urlmanaged-locale 0.0.1 -...

com.auth0:spring-security-auth0 (0.2), com.brienwheeler.web:web-spring-security (>=1.0-release, <=1.11) +34 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.2.4.release)

org.springframework.security:spring-security-web MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.auth0:spring-security-auth0 0.2 -...

com.cedac.spring.security:spring-security-mongodb (1.0.0), com.devonfw.modules:devonfw-winauth-ad (>=2.4.0, <=3.1.0) +90 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.2.7.release)

org.springframework.security:spring-security-web MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.cedac.spring.security:spring-security-mongodb 1.0.0...

ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), at.researchstudio.sat:won-cryptography (>=0.4, <=0.6) +101 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.2.9.release)

org.springframework.security:spring-security-web MAVEN version 4.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter...

org.jasig.cas:cas-server-webapp (>=3.4-rc1, <=3.4.3), org.springframework.security:spring-security-cas-client (3.0.1.release) +8 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.0.1.release)

org.springframework.security:spring-security-web MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.jasig.cas:cas-server-webapp =3.4-rc1, =3.4.3 -...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=1.12.0), com.atlassian.asap:asap-server-spring-security (>=2.21.8, <=2.21.9) +107 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.2.11.release)

org.springframework.security:spring-security-web MAVEN version 4.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - au.org.consumerdatastandards:client-cli =1.1.1, =2.21....

com.github.cwilper.fcrepo-cloudsync:fcrepo-cloudsync-service (>=1.0.0-beta-1, <=1.0.0), com.github.lltyk:tapestry-spring-security (>=3.0.2, <=3.0.3) +128 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.0.5.release)

org.springframework.security:spring-security-web MAVEN version 3.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: -...

am.ik.home:uaa-client (>=1.3.0, <=1.8.1), am.ik.home:uaa-integration-test (>=1.3.0, <=1.8.1) +86 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.2.1.release)

org.springframework.security:spring-security-web MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - am.ik.home:uaa-client =1.3.0, =1.3.0, =1.3.0, =0.2.0,...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +71 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.1.4.release)

org.springframework.security:spring-security-web MAVEN version 4.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =3.0.1.3,...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.10, <=0.1.11), ch.sharedvd.tipi:tipi-engine (>=1.1.10, <=1.1.11) +138 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.2.7.release)

org.springframework.security:spring-security-web MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter...

at.molindo.social:spring-social-security (1.1.4.release), com.foreach.across.modules:admin-web-module (1.1.1.release) +88 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.2.9.release)

org.springframework.security:spring-security-web MAVEN version 3.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - at.molindo.social:spring-social-security 1.1.4.release ...

org.springframework.security:spring-security-cas (3.1.5.release), org.springframework.security:spring-security-openid (3.1.5.release) +1 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.1.5.release)

org.springframework.security:spring-security-web MAVEN version 3.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.springframework.security:spring-security-cas...