CVE-2026-62242

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

CVE-2026-62242

CVE-2026-62242 affects Spring Boot Admin Server prior to 4.1.2. The vulnerability is a server-side request forgery in the unauthenticated instance registration flow, where attacker-controlled healthUrl and managementUrl are not validated against private IP ranges or metadata endpoints. This allow...

CVE-2026-62242 Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

CVE-2026-62242 Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

Exploit for Improper Input Validation in Snakeyaml_Project Snakeyaml

Seal Security — Java Maven Example A minimal, intentionally...

Spring Office Hours Podcast: S5E18 - The Latest from OpenAI, Anthropic and Spring AI 2.0

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun catch up on the fast moving world of AI and what it means for Java developers. The guys will cover recent releases from OpenAI and Anthropic, then dig into Spring AI 2.0, which is n...

A Bootiful Podcast: Spring Boot legend Moritz Halbritter on the latest and greatest in Spring Boot 4 and 4.1

Hi Spring fans! Spring Boot 4.1 is here and with it a ton of amazing features. I'm delighted to have had the opportunity to sit down with Moritz Halbritter, of Spring Boot and Spring Initializr fame, to talk about some of the amazing features...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0), org.webjars.npm:github-com-showdownjs-ng-showdown (1.1.0) +3 more potentially affected by CVE-2026-59710 via org.webjars.npm:showdown (>=1.9.1, <=2.1.0)

org.webjars.npm:showdown MAVEN version =1.9.1, =2.0.0, =1.0.2, =1.0.3 - org.webjars.npm:showdown-prism 0.2.0 Source cves: CVE-2026-59710 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17874451...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0), org.webjars.npm:github-com-showdownjs-ng-showdown (1.1.0) +3 more potentially affected by CVE-2026-59711 via org.webjars.npm:showdown (>=1.9.1, <=2.1.0)

org.webjars.npm:showdown MAVEN version =1.9.1, =2.0.0, =1.0.2, =1.0.3 - org.webjars.npm:showdown-prism 0.2.0 Source cves: CVE-2026-59711 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17874449...

Linux Distros Unpatched Vulnerability : CVE-2026-41001

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is...

Spring Office Hours Podcast: S5E17 - Spring Boot 4.1 with Phil Webb

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun are joined by Spring Boot co-creator and project lead Phil Webb to dig into what's new in Spring Boot 4.1. They walk through the headline features landing in this release, including...

ROOT-APP-MAVEN-CVE-2026-40973 CVE-2026-40973 in io.root.org.springframework.boot:spring-boot - Patched by Root

Root has patched CVE-2026-40973 in the io.root.org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41001 CVE-2026-41001 in io.root.org.springframework.boot:spring-boot - Patched by Root

Root has patched CVE-2026-41001 in the io.root.org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40992 CVE-2026-40992 in io.root.org.springframework.boot:spring-boot-autoconfigure - Patched by Root

Root has patched CVE-2026-40992 in the io.root.org.springframework.boot:spring-boot-autoconfigure package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40976 CVE-2026-40976 in io.root.org.springframework.boot:spring-boot - Patched by Root

Root has patched CVE-2026-40976 in the io.root.org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available...

CVE-2026-41001

A flaw was found in Spring Boot. The ArtemisEmbeddedConfigurationFactory component uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can exploit this by pre-creating this predictable directory ...

This Week in Spring - June 30th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring , a weekly recap in which we review the latest and greatest in the wide and wonderful world of Spring. You probably already knew this. I don't know if I needed to mention it. But I like to. I've been doing this every week,...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Spring Boot

Summary Multiple vulnerabilities in Spring Boot that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2026-40971 DESCRIPTION: When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when...

This Week in Spring - June 23rd, 2026

Hi Spring fans! In this installment, we look at the wide and wonderful world of Spring, as usual, and there's a good amount to get to, fresh off the recent Spring Boot 4.1 generation release train, so let's dive right into it! I wrote a blog post looking at Spring Batch, MongoDB, and Spring Boot...

MongoDB-backed Spring Batch jobs and more in Spring Boot 4.1

Spring Batch was introduced many years before MongoDB existed, and its design assumed the presence of a SQL database in which to store the state of Spring Batch jobs. But that was decades ago, and a common question for anyone new to Spring Batch was, "Why does this thing need to talk to a SQL...