CVE-2026-41695 Denial of Service in Spring Data Commons Property Path Resolution

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through...

CVE-2026-41695

Spring Data Commons contains a Denial of Service risk (CVE-2026-41695) caused by resource exhaustion during property path resolution in MappingContext. Affected versions are Spring Data Commons 4.0.0–4.0.5; 3.5.0–3.5.11; 3.4.0–3.4.14. The provided documents describe the issue and affected release...

CVE-2026-41694 SAML Payloads Decrypted Without Valid Signature

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0...

CVE-2026-41694 SAML Payloads Decrypted Without Valid Signature

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0...

CVE-2026-41694

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.9) +89 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.5.0, <=6.5.10)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.5.0, =1.0.0.ee-20260424025040, =11.14.0, =v6.3.3, =1.0.6, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.0, =15.1.3 and more Source cves: CVE-2026-41694https://vulners.com/cve/CVE-2026-4...

com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.8), com.trigyn:java-web-starter (>=2.2, <=2.13) +5 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.4.2, <=6.4.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.4.2, =2.2, =11.10.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =9.0-rc1, =1.15.0, =1.15.0, =2.4.0 Source cves: CVE-2026-41694 Source advisory: MEND:CVE-2026-41694...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.1.0, <=11.2.6.ee), io.spinnaker.gate:gate-api-tck (>=6.63.0, <=6.69.0) +7 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=5.7.2, <=5.7.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.7.2, =11.1.0, =6.63.0, =6.63.0, =6.63.0, =1.17.0, =1.17.0, =5.26.1, =5.26.1, =5.26.3 - zone.cogni.asquare:security2 0.7.0 Source cves: CVE-2026-41694 Source advisory: MEND:CVE-2026-41694...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-41694 Source advisory: MEND:CVE-2026-41694...

com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0, =1.52.0, =2.0.1, =4.0.0, =4.0.0, =4.0.0, =4.0.6 Source cves: CVE-2026-41694 Source advisory: MEND:CVE-2026-41694...

CVE-2026-41694 SAML Payloads Decrypted Without Valid Signature

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0...

com.trigyn:java-web-starter (>=1.6.0, <=2.1), com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.9.0, <=11.9.5.ee) +22 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=6.3.1, <=6.3.6)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.3.1, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0 and more Source cves: CVE-2026-41694 Source advisory:...

CVE-2026-41008 Spring Security Authorization Server Open Redirect via request_uri

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect...

CVE-2026-41008 Spring Security Authorization Server Open Redirect via request_uri

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect...

CVE-2026-41008

CVE-2026-41008 affects Spring Security and Spring Authorization Server. The vulnerability arises from insufficient validation of the request_uri parameter at the authorization endpoint, allowing an attacker to craft a malicious authorization request with an invalid request_uri and an unvalidated ...

CVE-2026-41008

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.10.0, <=3.49.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.10.0, <=3.49.0) +47 more potentially affected by CVE-2026-41008 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.5.0, <=1.5.7)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.5.0, =3.10.0, =3.10.0, =1.0.0, =1.0.1, =1.0.0, =3.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-41008 Source advisory:...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=4.0.0-alpha-springboot4, <=5.2.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=4.0.0-alpha-springboot4, <=5.2.0) +66 more potentially affected by CVE-2026-41008 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =3.6.0, =3.5.0, =5.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =2.0.1 -...

CVE-2026-41008 Spring Security Authorization Server Open Redirect via request_uri

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect...

CVE-2026-41003 Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting

An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10;...