ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38819 CVE-2024-38819 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38819 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

spring-RCE-CVE-2022-22965

Vulnerability Overview Recently, Spring released a major CVE vulnerability. The CVE information states: "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as ...

cve-2024-38821

cve-2024-38821 Analysis: https://www.deep-kondah.com/spring-webflux-static-resource-access-vulnerability-cve-2024-38821-explained/...

Spring-CVE

CVE de Spring Esto incluye CVE-2022-22963, una vulnerabilidad de acceso a recursos de expresión/SpEL de Spring, así como CVE-2022-22965, el RCE de spring-webmvc/spring-webflux denominado «SpringShell». CVE-2022-22963 En las versiones 3.1.6, 3.2.2 y anteriores no soportadas de Spring Cloud Functio...

PoC-CVE-2022-22965-Spring4Shell

PoC — CVE-2022-22965 Spring4Shell 免责声明： 本仓库仅供教育和研究目的 使用。 所有利用脚本必须仅针对您拥有或已获得明确书面授权测试的系统。作者不对因使用本材料造成的任何滥用或损害负责。 针对 CVE-2022-22965 的研究与概念验证，这是一个于 2022 年 4 月公开披露的严重 Spring Framework 远程代码执行（RCE）漏洞。 漏洞概述 Spring4Shell 影响 Spring MVC 和 Spring WebFlux 应用程序，当以下所有条件同时满足时： 条件| 值 ---|--- JDK 版本| 9 或更高 应用服务器|...

ROOT-APP-MAVEN-CVE-2024-38816 CVE-2024-38816 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38816 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22740 CVE-2026-22740 in org.springframework:spring-webflux - Patched by Root

Root has patched CVE-2026-22740 in the org.springframework:spring-webflux package for Root:Maven. Multiple fixed versions available...

Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure. id: CVE-2025-41243 info: name:...

cve-2024-38819-lab

CVE-2024-38819 Customer Vault Lab This is a Cloud Foundry-ready Spring Boot demo for CVE-2024-38819, a Spring Framework path traversal vulnerability in functional static resource handling. What Is Patched? CVE-2024-38819 is patched in Spring Framework , not directly in Spring Boot. Spring Boot is...

CVE-2026-47883

CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC This repository is a minimal reproduction PoC for CVE-2026-47883, published as an official Spring security advisory. Official advisory: https://spring.io/security/cve-2026-47883/ Official title: Spring Framework Open Redirect in...

cve-2024-38819

CVE-2024-38819 01. File-Traversal and Webflux Overview 1 File-Traversal and WebFlux Overview File-Traversal Path Traversal vulnerability allows an attacker to bypass file system permissions in a web application and access arbitrary files, and is a type of attack designated as CWE-22. Spring...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.3.25 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...

CVE-2026-47892

A flaw was found in Spring Framework. This vulnerability allows a header predicate bypass to occur in a pre-flight request within a WebFlux application that uses functional endpoints and is deployed with DispatcherServlet. This bypass could potentially lead to unexpected behavior or security poli...

Improper Authorization

Spring Framework is vulnerable to Improper Authorization. The vulnerability is due to a header predicate bypass in pre-flight requests for WebFlux functional endpoints deployed with DispatcherServlet, allowing an attacker to bypass intended header-based restrictions...

CVE-2026-47891

A flaw was found in Spring WebFlux applications that utilize the Aalto XML processor to parse XML input. A remote attacker could exploit this vulnerability by sending specially crafted XML, causing the application to bypass the maxInMemorySize limit. This can lead to excessive memory consumption,...

Linux Distros Unpatched Vulnerability : CVE-2026-47885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring...

Linux Distros Unpatched Vulnerability : CVE-2026-47892

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

Linux Distros Unpatched Vulnerability : CVE-2026-47891

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework...

Linux Distros Unpatched Vulnerability : CVE-2026-47893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception...