Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution

Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view...

spring-cloud-netflix-hystrix-dashboard-cve-2021-22053

CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability Severity High Vendor Spring by VMware Description Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI...

CVE-2021-22053

CVE-2021-22053 CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability Description Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the...

com.rabbitmq.jms:rabbitmq-jms (1.10.0), com.smoketurner.dropwizard:zipkin-core (1.3.7-1) +8 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (4.8.1)

com.rabbitmq:amqp-client MAVEN version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.rabbitmq.jms:rabbitmq-jms 1.10.0 - com.smoketurner.dropwizard:zipkin-core 1.3.7-1 -...

io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.4.3, <=5.5.1), org.springframework.amqp:spring-rabbit (1.7.10.release) +5 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.10.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - io.zipkin.brave:brave-instrumentation-spring-rabbit =5.4.3, =5.5.1 -...

org.springframework.amqp:spring-rabbit (1.4.6.release), org.springframework.boot:spring-boot-starter-amqp (>=1.2.7.release, <=1.2.8.release) +5 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.4.6.release)

org.springframework.amqp:spring-amqp MAVEN version 1.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.4.6.release -...

org.springframework.amqp:spring-rabbit (1.4.6.release), org.springframework.boot:spring-boot-starter-amqp (>=1.2.7.release, <=1.2.8.release) +5 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.4.6.release)

org.springframework.amqp:spring-amqp MAVEN version 1.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.4.6.release -...

cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp (1.0.2), io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.6.4, <=5.7.0) +8 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.13.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp 1.0.2 -...

com.github.codefrogcc:allocation (>=1.0.0, <=1.1.4), com.github.codefrogcc:commons-config (>=1.0.0, <=1.2.6) +8 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.8.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.github.codefrogcc:allocation =1.0.0, =1.0.0, =1.2.6 -...

com.github.codefrogcc:allocation (>=1.0.0, <=1.1.4), com.github.codefrogcc:commons-config (>=1.0.0, <=1.2.6) +8 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.8.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.github.codefrogcc:allocation =1.0.0, =1.0.0, =1.2.6 -...

io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.4.3, <=5.5.1), org.springframework.amqp:spring-rabbit (1.7.10.release) +5 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.10.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - io.zipkin.brave:brave-instrumentation-spring-rabbit =5.4.3, =5.5.1 -...

com.bluelock:camel-spring-amqp (1.7.0), org.springframework.amqp:spring-rabbit (1.4.3.release) +6 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.4.3.release)

org.springframework.amqp:spring-amqp MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.bluelock:camel-spring-amqp 1.7.0 - org.springframework.amqp:spring-rabbit...

CVE-2021-22053

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...

VulnCheck KEV: CVE-2020-5412

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can...

VulnCheck KEV: CVE-2021-22053

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...

org.springframework.cloud:spring-cloud-starter-hystrix-dashboard (1.0.1.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.0.1.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

org.springframework.cloud:spring-cloud-starter-hystrix-dashboard (1.0.2.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.0.2.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

org.springframework.cloud:spring-cloud-starter-hystrix-dashboard (1.0.4.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.0.4.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

org.springframework.cloud:spring-cloud-starter-hystrix-dashboard (1.0.6.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.0.7.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...

com.17jee:e-cloud-authorize (3.0.0.release) potentially affected by CVE-2021-22053 via org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard (1.1.3.release)

org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard and may be impacted: -...