12652 matches found
CLSA-2026-1788782570 TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 4 CVEs. Fixed in 4.2.9.RELEASE-tuxcare.11...
CLSA-2026-1788782067 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.16-tuxcare.5...
Improper Interceptor Addition
Spring Cloud Stream is vulnerable to improper interceptor addition. The vulnerability is due to an improperly added PartitionInterceptor while sending a message, where the interceptor is attached without adequate validation and attackers can send crafted messages to manipulate message routing or...
Deserialization Of Untrusted Data
Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to SerializingHttpMessageConverter deserializing HTTP request bodies using ObjectInputStream.readObject without class filtering, which allows an unauthenticated attacker to provide a crafted serialized...
Server-Side Request Forgery (SSRF)
Spring Integration is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of UDP inbound adapter requests, which allows an unauthenticated attacker to send a crafted UDP packet and cause the server to send UDP datagrams to arbitrary internal or...
Deserialization Of Untrusted Data
Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the jsonTypeId header being used to determine the deserialization target class without a type or package allow-list, which allows an attacker to specify a malicious class and potentially achieve...
Improper Access Control
Spring Data REST is vulnerable to Improper Access Control. The vulnerability is due to insufficient protection of identifier @Id and version @Version properties from mutation through RFC 6902 JSON Patch requests, which allows an attacker to modify these properties and potentially alter resource...
Unbounded Cache Size
Spring Cloud Stream is vulnerable to an unbounded cache size. The vulnerability is due to improper bounding of the dynamic destination cache size, where the cache can grow without limit and attackers can trigger excessive memory usage to cause a denial‑of‑service condition...
Sensitive Data Logging
Spring Cloud Function is vulnerable to Sensitive Data Logging. The vulnerability is due to insufficient redaction of sensitive information in its logging mechanisms, where request or response data may be written to logs without filtering and attackers can trigger the function with secret‑containi...
Scheme Verification Bypass
Spring Cloud Function is vulnerable to Scheme Verification Bypass. The vulnerability is due to the implementation of the isSecure method in ServerlessHttpServletRequest not verifying the actual scheme, where the method can report a request as secure even when the scheme is not HTTPS and an attack...
Server-Side Request Forgery (SSRF)
Spring Cloud Function is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled file or resource paths, allowing an attacker to read arbitrary local files or make requests to attacker-controlled or internal resources...
Denial Of Service
Spring for GraphQL is vulnerable to Denial of Service. The vulnerability is due to improper validation of pagination arguments in the Spring Data pagination support, where client‑supplied values are passed to the underlying repository and an attacker can forge a malicious query for a Connection...
Cross-Site Request Forgery (CSRF)
Spring for GraphQL is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the GraphiQL page allowing attacker-controlled URLs to trigger requests to application GraphQL endpoints, potentially causing confidential information to be leaked to the attacker's website...
Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Spring Web integration, Qute, OIDC, RESTEasy and SmallRye GraphQL Vulnerability Details CVEID:CVE-2026-19651 DESCRIPTION: Quarkus quarkus-spring-web extension could allow an attacker to bypass authorization by manipulating...
Use Of A Broken Or Risky Cryptographic Algorithm
Spring Security is vulnerable to Use of a Broken or Risky Cryptographic Algorithm. The vulnerability is due to AesBytesEncryptor using AES/CBC with a null all-zero initialization vector, which allows an attacker to exploit predictable encryption and potentially infer relationships between encrypt...
Arbitrary File Write
org.springframework.integration, spring-integration-zip is vulnerable to arbitrary file write. The vulnerability is due to improper validation of the filename header when processing messages with ZipResultType.FILE, which allows an attacker to specify an arbitrary filesystem path and cause the...
CLSA-2026-1788547257 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.0.11-tuxcare.4...
CLSA-2026-1788547255 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.16-tuxcare.4...