No title provided

A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources...

No title provided

A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources...

Resource Exhaustion

Spring Batch is vulnerable to resource exhaustion. The vulnerability is due to the way FlatFileItemReader assembles multi-line records, where a specially crafted input file can cause excessive CPU consumption and memory usage, leading the batch job to stall or run out of memory...

CLSA-2026-1788428259 TuxCare security update for org.springframework.data:spring-data-redis (4 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-redis to address 4 CVEs. Fixed in 3.3.13-tuxcare.4...

Deserialization RCE

Spring Batch is vulnerable to deserialization RCE. The vulnerability is due to the JobParameterDeserializer not properly enforcing the trusted-types allowlist, where applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer from an untrusted job repository can...

CLSA-2026-1788426720 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 2 CVEs. Fixed in 6.0.13-tuxcare.3...

CLSA-2026-1788426505 TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 4 CVEs. Fixed in 6.0.11-tuxcare.2...

CLSA-2026-1788426489 TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 3 CVEs. Fixed in 6.0.12-tuxcare.2...

Exploit for Missing Authorization in Vmware Spring_Boot

No d...

CLSA-2026-1788422167 TuxCare security update for org.springframework.data (4 CVEs)

TuxCare rebuilt 3 org.springframework.data packages to address 4 CVEs. Fixed in 4.3.13-tuxcare.4...

CLSA-2026-1788422148 TuxCare security update for org.springframework.data:spring-data-keyvalue (4 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 4 CVEs. Fixed in 3.3.13-tuxcare.4...

CLSA-2026-1788422135 TuxCare security update for org.springframework.data (2 CVEs)

TuxCare rebuilt 3 org.springframework.data packages to address 2 CVEs. Fixed in 4.3.13-tuxcare.5...

CLSA-2026-1788422044 TuxCare security update for org.springframework.data (4 CVEs)

TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4...

CLSA-2026-1788421934 TuxCare security update for org.springframework.data (4 CVEs)

TuxCare rebuilt 4 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4...

CLSA-2026-1788421913 TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.3.13-tuxcare.4...

CLSA-2026-1788420664 TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.3.13-tuxcare.5...

CLSA-2026-1788410329 TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.5-tuxcare.1...

PT-2026-85026

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL.toString.contains"/mgmt/". Tomcat returns getRequestURL un-decoded, while Spring MVC's...

A Bootiful Podcast: BellSoft's Catherine Edelveis on hardened runtime images, container security, and more

Hi, Spring fans! I chat with BellSoft’s Catherine Edelweiss about using buildpacks and hardened images to ship Spring Boot apps with stronger security, cleaner defaults, and far less Dockerfile pain. BellSoft Docker Java JRE SpringBoot...

CVE-2026-80515: Use of Non-Canonical URL Paths for Authorization Decisions

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL.toString.contains"/mgmt/". Tomcat returns getRequestURL un-decoded, while Spring MVC's...