CVE-2026-59313 Server Sent Event stream corruption in Spring MVC functional web framework

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

CVE-2026-59285

Spring for GraphQL (versions 2.0.0–2.0.4 ) is vulnerable to Unsafe Deserialization (CWE-502) when processing paginated GraphQL queries. The root cause lies in the deserialization of untrusted data via Jackson 2.x when handling a Connection (pagination) field . An attacker can execute arbitrary co...

EUVD-2026-67172

Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring...

CVE-2026-59283 Spring Framework Safety Guard Bypass via SpEL Expression Compilation

Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring...

CVE-2026-59283

Spring Framework 's spring-expression package is vulnerable to a safety guard bypass in SimpleEvaluationContext when the SpEL expression compiler is active. The vulnerability is only exploitable if the application evaluates SpEL expressions via SimpleEvaluationContext and the compiler is enabled ...

CVE-2026-59283

Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring...

CVE-2026-59282 Spring Framework Denial of Service via Unbounded List Growth in Data Binding

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

CVE-2026-59282

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

EUVD-2026-67171

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framewo...

CVE-2026-59282

Spring Framework applications using its data binding infrastructure may be vulnerable to a Denial of Service via unbounded list growth. The root cause lies in the org.springframework:spring-beans package: an attacker can supply a crafted property path with a large index value, causing unbounded a...

CVE-2026-59281 Spring Framework Cross-site Scripting via EscapedErrors

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-59281

Spring Framework versions 5.2.25.RELEASE and earlier through 7.0.8 are affected by a reflected cross-site scripting (XSS) vulnerability in Spring MVC and WebFlux. The root cause is that the no-argument Errors.getFieldErrors() and Errors.getFieldError() accessors return unescaped field error conte...

CVE-2026-59281

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

EUVD-2026-67170

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-59280

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...

DEBIAN-CVE-2026-59280

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...

CVE-2022-22965

POC Spring4Shell CVE-2022-22965 Spring4Shell CVE-2022-22965 Proof of Concept. Die Benennung dieser Schwachstelle basiert auf den Ähnlichkeiten mit dem berüchtigten Log4j LOG4Shell. Details zu dieser Schwachstelle https://websecured.io/blog/624411cf775ad17d72274d16/spring4shell-poc...

EUVD-2026-67094

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...

CVE-2026-59280

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...

CVE-2026-59280

Spring Framework applications using the FreeMarker integration are vulnerable to a path traversal attack via backslash in SpringTemplateLoader . The flaw occurs when a controller returns a view name derived from untrusted input while FreeMarker is configured to resolve templates through SpringTem...