193 matches found
cve-2024-38819
CVE-2024-38819 01. File-Traversal and Webflux Overview 1 File-Traversal and WebFlux Overview File-Traversal Path Traversal vulnerability allows an attacker to bypass file system permissions in a web application and access arbitrary files, and is a type of attack designated as CWE-22. Spring...
Spring-CVE
Spring CVE This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed "SpringShell". CVE-2022-22963 In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing...
spring-RCE-CVE-2022-22965
Описание уязвимости Недавно в Spring была обнаружена серьезная уязвимость CVE. Согласно информации CVE, "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as ...
PoC-CVE-2022-22965-Spring4Shell
PoC — CVE-2022-22965 Spring4Shell Disclaimer: This repository is intended for educational and research purposes only. All exploit scripts must be used exclusively against systems you own or have explicit written permission to test. The author is not responsible for any misuse or damage caused by...
CVE-2026-47883
CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC 이 저장소는 Spring 공식 보안 권고문으로 공개된 CVE-2026-47883의 최소 재현 PoC입니다. 공식 권고문: https://spring.io/security/cve-2026-47883/ 공식 제목: Spring Framework Open Redirect in UrlHandlerFilter 심각도: Medium CVSS v3.1: 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A...
cve-2024-38821
cve-2024-38821 Analisi: https://www.deep-kondah.com/spring-webflux-static-resource-access-vulnerability-cve-2024-38821-explained/...
CVE-2026-47890
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...
CVE-2026-47885
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...
CVE-2026-47883
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...
CVE-2026-47883
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...
CVE-2026-47885
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...
CVE-2026-47890
Spring Framework versions 7.0.0–7.0.8 and 6.2.0–6.2.19 are affected by a stream corruption issue when Server-Sent Events (SSE) are used with view fragments in Spring MVC and WebFlux applications. The NVD-assigned CVSS 3.1 score is 9.8 (Critical) , while the vendor (Spring) classifies it as LOW se...
CVE-2026-47885 Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...
CVE-2026-47885
This vulnerability affects the PartEventHttpMessageReader in Spring WebFlux , which fails to enforce the maxPartSize limit when maxInMemorySize is set to -1, potentially allowing oversized multipart data to be processed without the intended size constraint. Affected versions are Spring Framework ...
CVE-2026-47883 Spring Framework Open Redirect in UrlHandlerFilter
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...
EUVD-2026-66851
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...
CVE-2026-47883
Spring Framework 's UrlHandlerFilter is vulnerable to an open redirect (CWE-601) when configured with very broadly matching patterns, potentially generating headers that point to external origins. The issue affects both Spring MVC and Spring WebFlux filter variants in Spring Framework 6.2.0–6.2.1...
CVE-2026-41847
A flaw was found in Spring WebFlux applications. This vulnerability allows for a security bypass when using the Kotlin Router DSL. An attacker could exploit this to bypass security restrictions, potentially leading to unauthorized access. Mitigation This vulnerability only applies when using Kotl...
CVE-2026-41840
A flaw was found in Spring WebFlux applications. A remote attacker could exploit this vulnerability by sending specially crafted multipart requests, leading to a Denial of Service DoS condition. This could make the application unavailable to legitimate users. Mitigation No specific mitigation is...
