ch.inftec.ju:ju-dbutil-test-legacy (4.1), ch.ralscha:extdirectspring (>=1.3.0, <=1.3.1) +194 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (3.2.1.release)

org.springframework:spring-core MAVEN version 3.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ch.inftec.ju:ju-dbutil-test-legacy 4.1 - ch.ralscha:extdirectspring =1.3.0, =0.4.1, =0.1....

ar.com.jmfsg:api-doc (>=0.0.28, <=0.0.34), ch.ralscha:extdirectspring (>=1.3.2, <=1.3.5) +241 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.2.release)

org.springframework:spring-expression MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ar.com.jmfsg:api-doc =0.0.28, =1.3.2, =1.0.0, =1.6.0, =2.100.0, =2.0.2, =2.0....

at.chrl:chrl-jms (1.1.0), at.chrl:chrl-orm-spring-integration (1.1.0) +428 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.2.1.release)

org.springframework:spring-core MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - at.chrl:chrl-jms 1.1.0 - at.chrl:chrl-orm-spring-integration 1.1.0 -...

cn.deepbit:deepbit-sdk (8.3.7), cn.deepbit:deepbit-start-mvc (8.3.7) +501 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.23.release)

org.springframework:spring-expression MAVEN version 4.3.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.deepbit:deepbit-sdk 8.3.7 - cn.deepbit:deepbit-start-mvc 8.3.7 -...

com.alibaba.citrus:citrus-springext-all (>=3.1.6, <=3.2.4), com.alibaba.citrus:citrus-test-all (>=3.1.6, <=3.2.4) +62 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.2.7.release)

org.springframework:spring-expression MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.alibaba.citrus:citrus-springext-all =3.1.6, =3.1.6, =3.1.6, =0.10.0,...

at.molindo:molindo-notify (>=1.0.0-alpha-1, <=1.0.0-alpha-2), ca.grimoire.spring:spring-request-aware (1.0) +232 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (3.0.4.release)

org.springframework:spring-expression MAVEN version 3.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo:molindo-notify =1.0.0-alpha-1, =1.0.2, =1.1.1, =1.0.3, =1.0.1,...

GHSA-659M-PX2C-25WJ Spring Framework Denial of Service via AntPathMatcher

Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: matchString pattern, String path, matchStartString pattern, String pat...

cc.akkaha:pea-dubbo_2.12 (>=0.6.0, <=0.7.0), cc.akkaha:pea_2.12 (>=0.6.0, <=0.7.0) +1263 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.3.16.release)

org.springframework:spring-core MAVEN version 4.3.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - cc.akkaha:pea-dubbo2.12 =0.6.0, =0.6.0, =v1.0.0, =0.0.8.oss, =0.0.1, =0.0.1, =0.0.1,...

com.aol.microservices:micro-general-exception-mapper (>=0.77, <=0.91.11), com.aol.microservices:micro-grizzly-with-jersey (>=0.62, <=0.91.8) +609 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (3.2.3.release)

org.springframework:spring-core MAVEN version 3.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.aol.microservices:micro-general-exception-mapper =0.77, =0.62, =0.62, =0.91.3, =0.80,...

ai.foremast.metrics:foremast-spring-boot-15x-starter (0.1.8), cn.ymotel:largedatabtach (>=1.0.1, <=1.0.4) +630 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.20.release)

org.springframework:spring-expression MAVEN version 4.3.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter 0.1.8 -...

ca.krasnay:sqlbuilder (1.2), co.paralleluniverse:comsat-spring-boot (0.3.0) +179 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.0.8.release)

org.springframework:spring-core MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ca.krasnay:sqlbuilder 1.2 - co.paralleluniverse:comsat-spring-boot 0.3.0 -...

at.chrl:chrl-jms (1.1.0), at.chrl:chrl-orm-spring-integration (1.1.0) +388 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.2.1.release)

org.springframework:spring-expression MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.chrl:chrl-jms 1.1.0 - at.chrl:chrl-orm-spring-integration 1.1.0 -...

Spring Framework Denial of Service via AntPathMatcher

Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: matchString pattern, String path, matchStartString pattern, String pat...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +19158 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (>=6.2.0, <=6.2.18)

org.springframework:spring-expression MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.9.0 and more Source cves: CVE-2026-41852 Source advisory: OSV:GHSA-9F52-RJQV-25QV...

org.springframework:spring-aop (1.2.1), org.springframework:spring-beans (1.2.1) +10 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (1.2.1)

org.springframework:spring-core MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.1 - org.springframework:spring-beans 1.2.1 -...

be.objectify:deadbolt-java-gs_2.11 (2.6.0), be.objectify:deadbolt-java-gs_2.12 (2.6.0) +1763 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.3.9.release)

org.springframework:spring-core MAVEN version 4.3.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - be.objectify:deadbolt-java-gs2.11 2.6.0 - be.objectify:deadbolt-java-gs2.12 2.6.0 -...

GHSA-9F52-RJQV-25QV Spring Framework Arbitrary Method Invocation in SpEL Expressions

A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2....

ch.sbb.releasetrain:action (0.0.25), ch.sbb.releasetrain:config (0.0.25) +551 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.2.7.release)

org.springframework:spring-expression MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.sbb.releasetrain:action 0.0.25 - ch.sbb.releasetrain:config 0.0.25 -...

ch.ralscha:extdirectspring (1.2.3), ch.tatool:tatool-app (>=1.3, <=1.3.2) +437 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (3.1.3.release)

org.springframework:spring-core MAVEN version 3.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ch.ralscha:extdirectspring 1.2.3 - ch.tatool:tatool-app =1.3, =1.3, =1.3, =0.16.5, =0.16....

at.molindo:molindo-notify (2.1.0), be.dnsbelgium:rdap-server (1.1.0) +707 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.1.7.release)

org.springframework:spring-core MAVEN version 4.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - at.molindo:molindo-notify 2.1.0 - be.dnsbelgium:rdap-server 1.1.0 -...