ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.9) +89 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=6.5.0, <=6.5.10)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.5.0, =1.0.0.ee-20260424025040, =11.14.0, =v6.3.3, =1.0.6, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.1.3 and more Source cves: CVE-2026-40988https://vulners.com/cve/CVE-2026-4...

com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.8), com.trigyn:java-web-starter (>=2.2, <=2.13) +5 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.4.2, <=6.4.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.4.2, =2.2, =11.10.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =9.0-rc1, =1.15.0, =1.15.0, =2.4.0 Source cves: CVE-2026-41694 Source advisory: GHSA-WW38-37G9-M3Q3...

com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.8), com.trigyn:java-web-starter (>=2.2, <=2.13) +5 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=6.4.2, <=6.4.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.4.2, =2.2, =11.10.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =9.0-rc1, =1.15.0, =1.15.0, =2.4.0 Source cves: CVE-2026-40988 Source advisory: GHSA-M69X-PW9P-7J3Q...

com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.8), com.trigyn:java-web-starter (>=2.2, <=2.13) +5 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=6.4.2, <=6.4.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.4.2, =2.2, =11.10.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =9.0-rc1, =1.15.0, =1.15.0, =2.4.0 Source cves: CVE-2026-40988 Source advisory: OSV:GHSA-M69X-PW9P-7J3Q...

GHSA-5VPF-XVV7-C8VH Spring Data Commons: StackOverflowException when parsing Sort parameters (DoS)

Applications using Spring Data Commons may be vulnerable to a Denial of Service DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through...

Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)

An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory. Affected versions: Spring Security 5.7.0 through 5.7.23;...

Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0...

Spring Data Commons: StackOverflowException when parsing Sort parameters (DoS)

Applications using Spring Data Commons may be vulnerable to a Denial of Service DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through...

GHSA-M69X-PW9P-7J3Q Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)

An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory. Affected versions: Spring Security 5.7.0 through 5.7.23;...

EUVD-2026-35889

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0...

EUVD-2026-35897

Applications using Spring Data Commons may be vulnerable to a Denial of Service DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through...

ch.sharedvd.tipi:tipi-engine (>=1.1.10, <=1.1.11), com.actionsky:txle-autocompensation (>=2.19.10.0, <=2.19.11.0) +100 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.13.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - ch.sharedvd.tipi:tipi-engine =1.1.10, =2.19.10.0, =2.19.10.0,...

com.arpit9mittal.fmk:common-application-framework-core (>=1.0.0-rc1, <=1.0.0-rc2), com.arpit9mittal.fmk:common-application-framework-parent (>=1.0.0-rc1, <=1.0.0-rc2) +162 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.11.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.arpit9mittal.fmk:common-application-framework-core...

com.4dconcept.springframework.data:spring-data-marklogic (1.2.0.release), com.blazebit:blaze-persistence-examples-showcase-fragments-spring-data (>=1.2.0-alpha5, <=1.6.6) +157 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.10.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.4dconcept.springframework.data:spring-data-marklogic...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +391 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

com.ifrabbit:spring-boot-starter-data-mybatis (1.0.17.release), com.ifrabbit:spring-data-mybatis (1.0.17.release) +28 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.5.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - com.ifrabbit:spring-boot-starter-data-mybatis 1.0.17.release -...

at.researchstudio.sat:won-core (>=0.2, <=0.3), at.researchstudio.sat:won-cryptography (0.3) +175 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.3.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - at.researchstudio.sat:won-core =0.2, =0.2, =0.2, =0.2, =0.2,...

am.ik.blog:blog-mapper (>=4.0.0, <=4.4.0), am.ik.home:uaa-client (1.9.0) +316 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.1.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - am.ik.blog:blog-mapper =4.0.0, =1.0.2.release, =1.2.0-alpha3,...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-40988 Source advisory: OSV:GHSA-M69X-PW9P-7J3Q...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.0.0.beta.ee-20220401222842, <=11.2.6.ee), io.spinnaker.gate:gate-api-tck (>=6.63.0, <=6.69.0) +8 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=5.6.2, <=5.7.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.6.2, =11.0.0.beta.ee-20220401222842, =6.63.0, =6.63.0, =6.63.0, =1.17.0, =1.17.0, =5.26.0, =5.26.0, =0.6.4-b, =0.7.0 - zone.cogni.lib.security:security 1.2.5 Source cves: CVE-2026-40988 Source advisory:...