Improper Input Validation

org.springframework.cloud, spring-cloud-context is vulnerable to improper input validation. The vulnerability is due to the absence of property-key allow-list validation, which allows an attacker with access to the writable /actuator/env endpoint to inject or modify arbitrary environment properti...

Safety Guard Bypass

Spring Framework is vulnerable to a safety guard bypass. The vulnerability is due to improper enforcement of security restrictions during compiled SpEL expression evaluation, which allows an attacker to bypass the intended safety protections and execute expressions with capabilities that should...

Denial-of-Service (DoS)

Spring Framework is vulnerable to a Denial-of-Service DoS. The vulnerability is due to insufficient validation of user-supplied property paths during data binding, which allows an attacker to submit specially crafted property paths that consume excessive resources and potentially cause the...

Improper Authentication

Spring Security is vulnerable to Improper Authentication. The vulnerability is due to user verification state not being properly maintained with a distributed HTTP session store, allowing an attacker to bypass WebAuthn user verification...

Improper Caching

Spring Cloud Stream is vulnerable to improper caching of the original content type. The vulnerability is due to the Avro handling component caching the original content type, where the cached value is reused for subsequent messages and an attacker can supply a crafted content type to cause...

Denial Of Service (DoS)

Spring AI is vulnerable to Denial of Service DoS. The vulnerability is due to the MCP Streamable HTTP server transport retaining an unbounded number of unauthenticated sessions, which allows a remote attacker to exhaust server memory over time and ultimately cause a denial of service affecting...

Improper Input Validation

Spring Integration is vulnerable to Improper Input Validation. The vulnerability is due to a non-thread-safe ScriptEngine instance being reused across concurrent message processing, potentially causing message data leakage between script evaluations or spurious exceptions...

HTTP Response Splitting

Spring Framework is vulnerable to HTTP response splitting. The vulnerability is due to building a Content-Disposition header value from untrusted input, where the input file name is used without proper sanitization and attackers can supply a malicious file name containing CRLF characters to split...

CLEANSTART-2026-ED42524 Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded...

Multiple security vulnerabilities affect the spring-boot package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth. See references for...

CLEANSTART-2026-GZ54612 In Spring Security, versions 5

Multiple security vulnerabilities affect the apache-nifi package. In Spring Security, versions 5. See references for individual vulnerability details...

CVE-2026-47837

A flaw was found in Spring Cloud Config Server. This vulnerability allows an unauthenticated remote attacker to send webhook requests to the /monitor endpoint without validation. This lack of authentication for a critical function could lead to a denial of service DoS condition, making the server...

Improper Preservation Of Message Metadata

Spring Integration is vulnerable to improper preservation of message metadata. The vulnerability is due to reply and propagated headers being copied from the most recently consumed upstream message when .fluxTransform processes raw payloads asynchronously or out of order, which allows an attacker...

Man-in-the-Middle

Spring Integration is vulnerable to Man-in-the-Middle attacks. The vulnerability is due to the jCIFS client negotiating down to SMB1/CIFS unless the application explicitly raises smbMinVersion, where SMB1/CIFS lacks mandatory signing/encryption and attackers can perform NTLM relay and...

Improper Handling Of Untrusted Message Headers

Spring Integration is vulnerable to improper handling of untrusted message headers. The vulnerability is due to the EmbeddedHeadersJsonMessageMapper deserializing embedded JSON headers into a Map and creating message headers without sanitizing or filtering untrusted header names by default, which...

Denial Of Service

Spring Integration is vulnerable to Denial of Service. The vulnerability is due to the UnZipTransformer not limiting decompressed entry size or entry count when processing archives, where an attacker can send a crafted zip archive that exhausts JVM heap memory and causes a denial-of-service outag...

Open Redirect

Spring Authorization Server is vulnerable to open redirect. The vulnerability is due to insufficient validation of the requesturi parameter, where the authorization endpoint allows an attacker to craft a request containing an invalid requesturi paired with an unvalidated redirecturi, resulting in...

Improper Input Validation

Spring for Apache Kafka is vulnerable to an integer parsing denial-of-service. The vulnerability is due to the application passing attacker-controlled header bytes directly to BigInteger without length or format validation, which allows an attacker to exploit the issue by supplying a maliciously...

Denial-of-Service (DoS)

Spring Cloud Config is vulnerable to a Denial-of-Service DoS. The vulnerability is due to the Spring Cloud Config Monitor processing maliciously crafted payloads, which allows an attacker to send specially crafted requests that can exhaust application resources and cause the affected service to...

Deserialization Protection Bypass

org.springframework.integration, spring-integration-jdbc is vulnerable to a deserialization protection bypass. The vulnerability is due to JdbcMessageStore.addAllowedPatterns... providing no effective protection when the store is configured as a Spring-managed bean, which allows an attacker to...

RediSearch Injection

Spring AI is vulnerable to RediSearch Injection. The vulnerability is due to RedisChatMemoryRepository.findByMetadata using unsanitized metadata values in RediSearch queries, allowing an attacker to inject RediSearch syntax and retrieve chat messages across conversations...