spring-RCE-CVE-2022-22965

مقدمة الثغرة في الآونة الأخيرة، كشفت Spring عن ثغرة CVE من العيار الثقيل. تُظهر معلومات CVE ما يلي: "قد يكون تطبيق Spring MVC أو Spring WebFlux الذي يعمل على JDK 9+ عرضةً لتنفيذ التعليمات البرمجية عن بُعد RCE عبر ربط البيانات. يتطلب الاستغلال المحدد تشغيل التطبيق على Tomcat كنشر WAR. إذا تم نشر...

Spring-CVE

Spring CVE Cela inclut CVE-2022-22963, une vulnérabilité d'accès aux ressources Spring SpEL / Expression, ainsi que CVE-2022-22965, la RCE spring-webmvc/spring-webflux nommée "SpringShell". CVE-2022-22963 Dans les versions 3.1.6, 3.2.2 et les versions non supportées antérieures de Spring Cloud...

ROOT-APP-MAVEN-CVE-2024-38819 CVE-2024-38819 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38819 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

CVE-2026-107375

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375

Applications generated using JHipster (versions 7.0.0 through 9.4.0) are vulnerable to SQL Injection when using Spring WebFlux , Spring Data R2DBC , and a SQL database. The vulnerability exists because the sort request parameter from paginated entity-list endpoints is passed into the createOrderB...

CLEANSTART-2026-VX49826 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1

Security vulnerability affects the apache-nifi-registry package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...

CLEANSTART-2026-AY49632 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the apache-nifi-registry package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

cve-2024-38821

cve-2024-38821 التحليل: https://www.deep-kondah.com/spring-webflux-static-resource-access-vulnerability-cve-2024-38821-explained/...

PoC-CVE-2022-22965-Spring4Shell

PoC — CVE-2022-22965 Spring4Shell إخلاء مسؤولية: هذا المستودع مخصّص لأغراض تعليمية وبحثية فقط. يجب استخدام جميع نصوص الاستغلال حصريًا ضد الأنظمة التي تملكها أو لديك إذن كتابي صريح لاختبارها. المؤلف غير مسؤول عن أي إساءة استخدام أو ضرر ناتج عن هذه المادة. دراسة وإثبات مفهوم لثغرة CVE-2022-22965، و...

CLEANSTART-2026-IY13000 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the rundeck package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

CLEANSTART-2026-LS35751 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit

Security vulnerability affects the rundeck package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...

CLEANSTART-2026-GL50057 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1

Security vulnerability affects the rundeck package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...

Security Bulletin: Due to the use of Spring WebFlux, IBM Sterling Control Center is vulnerable to multiple CVEs (CVE-2026-47883, CVE-2026-47885, CVE-2026-47889, CVE-2026-47891 )

Summary Spring WebFlux is used by IBM Sterling Control Center and as part of dependency one of them is in spring-web-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47883 DESCRIPTION: UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38816 CVE-2024-38816 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38816 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

CVE-2026-47883

CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC Ce dépôt est un PoC de reproduction minimale de CVE-2026-47883, publié dans l'avis de sécurité officiel de Spring. Avis officiel : https://spring.io/security/cve-2026-47883/ Titre officiel : Spring Framework Open Redirect in...

Security Bulletin: Vulnerability reported in jackson-core-2.18.6.jar for APIM 11.1 is now addressed

Summary Vulnerability reported in jackson-core-2.18.6.jar for APIM 11.1 is now addressed Vulnerability Details CVEID:CVE-2026-68494 DESCRIPTION: The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is...

cve-2024-38819

CVE-2024-38819 01. Aperçu de File-Traversal et WebFlux 1 Aperçu de File-Traversal et de WebFlux La vulnérabilité File-Traversal parcours de chemin, Path Traversal permet à un attaquant de contourner les autorisations du système de fichiers dans une application web et d'accéder à des fichiers...