org.springmodules:spring-modules-jakarta-commons (0.7), org.springmodules:spring-modules-osworkflow (0.7) potentially affected by CVE-2026-41843 via org.springframework:spring-webmvc (2.0.1)

org.springframework:spring-webmvc MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springmodules:spring-modules-jakarta-commons 0.7 -...

org.springmodules:spring-modules-jakarta-commons (0.7), org.springmodules:spring-modules-osworkflow (0.7) potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (2.0.1)

org.springframework:spring-webmvc MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springmodules:spring-modules-jakarta-commons 0.7 -...

org.springmodules:spring-modules-jakarta-commons (0.7), org.springmodules:spring-modules-osworkflow (0.7) potentially affected by CVE-2026-41844 via org.springframework:spring-webmvc (2.0.1)

org.springframework:spring-webmvc MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springmodules:spring-modules-jakarta-commons 0.7 -...

ai.koog:koog-spring-ai-starter-chat-memory (>=0.8.0-rc-1, <=1.3.0-beta), ai.koog:koog-spring-ai-starter-model-chat (>=0.7.0, <=1.3.0-beta) +3713 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (>=1.15.0, <=1.15.11)

io.micrometer:micrometer-core MAVEN version =1.15.0, =0.8.0-rc-1, =0.7.0, =0.7.0, =0.8.0-rc-1, =1.0.0, =1.0.0, =1.23.0, =1.23.0, =1.23.0, =0.6.0, =1.6.0, =1.5.4, =1.0.0, =0.9.0, =1.0.1 and more Source cves: CVE-2026-40984 Source advisory: OSV:GHSA-G3PR-3P32-FP23...

io.micrometer:micrometer-registry-atlas (0.12.0.release), io.micrometer:micrometer-registry-datadog (0.12.0.release) +6 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.12.0.release)

io.micrometer:micrometer-core MAVEN version 0.12.0.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - io.micrometer:micrometer-registry-atlas 0.12.0.release -...

io.micrometer:micrometer-atlas-starter (0.9.0.release), io.micrometer:micrometer-datadog-starter (0.9.0.release) +6 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.9.0.release)

io.micrometer:micrometer-core MAVEN version 0.9.0.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - io.micrometer:micrometer-atlas-starter 0.9.0.release - io.micrometer:micrometer-datadog-start...

io.micrometer:micrometer-atlas-starter (0.6.3.release), io.micrometer:micrometer-datadog-starter (0.6.3.release) +2 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.6.3.release)

io.micrometer:micrometer-core MAVEN version 0.6.3.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - io.micrometer:micrometer-atlas-starter 0.6.3.release - io.micrometer:micrometer-datadog-start...

io.micrometer:micrometer-atlas-starter (0.7.0.release), io.micrometer:micrometer-datadog-starter (0.7.0.release) +2 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.7.0.release)

io.micrometer:micrometer-core MAVEN version 0.7.0.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - io.micrometer:micrometer-atlas-starter 0.7.0.release - io.micrometer:micrometer-datadog-start...

io.micrometer:micrometer-atlas-starter (0.9.1.release), io.micrometer:micrometer-datadog-starter (0.9.1.release) +6 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.9.1.release)

io.micrometer:micrometer-core MAVEN version 0.9.1.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - io.micrometer:micrometer-atlas-starter 0.9.1.release - io.micrometer:micrometer-datadog-start...

io.micrometer:micrometer-atlas-starter (0.8.0.release), io.micrometer:micrometer-datadog-starter (0.8.0.release) +5 more potentially affected by CVE-2026-40984 via io.micrometer:micrometer-core (0.8.0.release)

io.micrometer:micrometer-core MAVEN version 0.8.0.release is affected by a known vulnerability. The following packages have a transitive dependency on io.micrometer:micrometer-core and may be impacted: - io.micrometer:micrometer-atlas-starter 0.8.0.release - io.micrometer:micrometer-datadog-start...

CVE-2026-41853

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

CVE-2026-41850

Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or...

CVE-2026-41854

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery SSRF attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18...

CVE-2026-41852

A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2....

CVE-2026-41849

An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language SpEL. An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service DoS. Affected versions: Spring...

CVE-2026-41851

Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0...

CVE-2026-41855

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affect...

CVE-2026-41847

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48...

CVE-2026-41844

A Spring MVC or Spring WebFlux application which configures a mapping for "/" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix. Affected versions: Spring Framework 7.0.0 through...

CVE-2026-41848

Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher: matchString pattern, String path, matchStartString pattern, String pat...