be.rufer.swisscom.sms:api-client (1.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (0.9) +233 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.1.3.release)

org.springframework:spring-expression MAVEN version 4.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - be.rufer.swisscom.sms:api-client 1.0 -...

org.acegisecurity:acegi-security (>=1.0.0-rc2, <=1.0.0), org.acegisecurity:acegi-security-adapters (1.0.0) +20 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.0-m2)

org.springframework:spring-core MAVEN version 2.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.acegisecurity:acegi-security =1.0.0-rc2, =1.0.0 - org.acegisecurity:acegi-security-adapters...

ca.islandora.alpaca:islandora-connector-broadcast (>=0.2.0, <=0.3.0), cn.kstry.framework:kstry-core (>=1.0.0, <=1.1.14) +670 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.1.9.release)

org.springframework:spring-core MAVEN version 4.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ca.islandora.alpaca:islandora-connector-broadcast =0.2.0, =1.0.0, =2.0.0-rc2, =2.0.0-rc2,...

org.apache.servicemix.examples:org.apache.servicemix.examples.itests.tests (4.2.0), org.apache.servicemix.jbi.cluster:org.apache.servicemix.jbi.cluster.requestor (1.2.0) potentially affected by CVE-2026-41855 via org.springframework:spring-jms (2.5.6.sec01)

org.springframework:spring-jms MAVEN version 2.5.6.sec01 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.servicemix.examples:org.apache.servicemix.examples.itests.tests 4.2.0 -...

org.apache.camel:camel-itest-spring32 (>=2.17.0, <=2.17.7), org.springframework.integration:spring-integration-jms (3.0.8.release) potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.2.15.release)

org.springframework:spring-jms MAVEN version 3.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.camel:camel-itest-spring32 =2.17.0, =2.17.7 -...

com.jdroidframework:jdroid-java-webapp-core (0.10.0), com.jdroidtools:jdroid-java-webapp-core (1.0.0) +18 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (3.2.18.release)

org.springframework:spring-webmvc MAVEN version 3.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.jdroidframework:jdroid-java-webapp-core 0.10.0 -...

cn.jairdavis:jair-common-utils (1.0.4), com.allenru:cross-origin (1.0.1) +171 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.0.2.release)

org.springframework:spring-expression MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - cn.jairdavis:jair-common-utils 1.0.4 - com.allenru:cross-origin 1.0.1 -...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.1.1, <=0.112.0) +1744 more potentially affected by CVE-2026-41853 via org.springframework:spring-webflux (>=6.1.0, <=6.1.21)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =0.5.0, =1.2.0, =1.1.0, =1.3.0 and more Source cves: CVE-2026-41853 Source advisory: GHSA-CJPG-RGQ5-FR37...

org.apache.activemq:activemq-camel (5.2.0), org.apache.activemq:activemq-web (5.2.0) +43 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (2.5.5)

org.springframework:spring-jms MAVEN version 2.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.activemq:activemq-camel 5.2.0 - org.apache.activemq:activemq-web 5.2.0 -...

ai.platon.pulsar:browser4-rest (>=4.13.5, <=4.14.3), ai.platon.pulsar:pulsar-e2e-tests (>=4.5.0, <=4.6.0) +2815 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (>=7.0.0, <=7.0.7)

org.springframework:spring-webmvc MAVEN version =7.0.0, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.10.9 and more Source cves: CVE-2026-41853 Source advisory: OSV:GHSA-CJPG-RGQ5-FR37...

net.sf.hermesftp:hermesftp (0.7), net.sf.ldaptemplate:ldaptemplate (>=1.0-rc1, <=1.0.2) +24 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (1.2.6)

org.springframework:spring-core MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - net.sf.hermesftp:hermesftp 0.7 - net.sf.ldaptemplate:ldaptemplate =1.0-rc1, =1.0.0-rc2, =1.7,...

be.looorent:jflu-producer-springmvc (>=0.1, <=0.13.6), ch.ralscha:extdirectspring (1.7.1) +407 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (4.3.4.release)

org.springframework:spring-webmvc MAVEN version 4.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - be.looorent:jflu-producer-springmvc =0.1, =1.1, =1.0.10, =1.0, =1.0.7.oss, =1.0.7.oss...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +7260 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (>=6.2.0, <=6.2.18)

org.springframework:spring-webmvc MAVEN version =6.2.0, =0.5.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-41853 Source advisory: OSV:GHSA-CJPG-RGQ5-FR37...

io.hyte.platform:hyte-mq (>=4.2.10.hyte-42101, <=4.2.10.hyte-42102), org.apache.activemq:activemq-camel (5.15.14) +4 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.3.29.release)

org.springframework:spring-jms MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - io.hyte.platform:hyte-mq =4.2.10.hyte-42101, =4.2.10.hyte-42102 -...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0) +16455 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (>=6.1.0, <=6.1.21)

org.springframework:spring-expression MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0-beta.2 - ai.djl.spring:djl-spring-boot-starter-autoconfigure 0.26 - ai.djl.spring:djl-spring-boot-starter-mxnet-auto 0.26 and more Source cves:...

ch.ralscha:extdirectspring (1.7.3), cn.afterturn:easypoi-spring-boot-starter (>=0.1, <=0.1.1) +1953 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.12.release)

org.springframework:spring-expression MAVEN version 4.3.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ch.ralscha:extdirectspring 1.7.3 - cn.afterturn:easypoi-spring-boot-starter...

Spring LDAP has Authentication Bypass with Empty Password

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3...

Spring Framework Predictable Session ID in WebSocket Module

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consulting Jackson access-control annotations. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3...

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...