spring-RCE-CVE-2022-22965

Vulnerability Overview Recently, Spring released a major CVE vulnerability. The CVE information states: "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as ...

Spring-CVE

CVE de Spring Esto incluye CVE-2022-22963, una vulnerabilidad de acceso a recursos de expresión/SpEL de Spring, así como CVE-2022-22965, el RCE de spring-webmvc/spring-webflux denominado «SpringShell». CVE-2022-22963 En las versiones 3.1.6, 3.2.2 y anteriores no soportadas de Spring Cloud Functio...

ROOT-APP-MAVEN-CVE-2024-38819 CVE-2024-38819 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38819 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

CVE-2026-107375

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375

Applications generated using JHipster (versions 7.0.0 through 9.4.0) are vulnerable to SQL Injection when using Spring WebFlux , Spring Data R2DBC , and a SQL database. The vulnerability exists because the sort request parameter from paginated entity-list endpoints is passed into the createOrderB...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CLEANSTART-2026-VX49826 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1

Security vulnerability affects the apache-nifi-registry package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...

CLEANSTART-2026-AY49632 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the apache-nifi-registry package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

cve-2024-38821

cve-2024-38821 Análisis: https://www.deep-kondah.com/spring-webflux-static-resource-access-vulnerability-cve-2024-38821-explained/...

PoC-CVE-2022-22965-Spring4Shell

PoC — CVE-2022-22965 Spring4Shell Aviso legal: Este repositorio está destinado únicamente a fines educativos y de investigación. Todos los scripts de exploit deben utilizarse exclusivamente contra sistemas que posea o para los que tenga permiso explícito por escrito para realizar pruebas. El auto...

CLEANSTART-2026-IY13000 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the rundeck package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

CLEANSTART-2026-LS35751 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit

Security vulnerability affects the rundeck package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...

CLEANSTART-2026-GL50057 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1

Security vulnerability affects the rundeck package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...

Security Bulletin: Due to the use of Spring WebFlux, IBM Sterling Control Center is vulnerable to multiple CVEs (CVE-2026-47883, CVE-2026-47885, CVE-2026-47889, CVE-2026-47891 )

Summary Spring WebFlux is used by IBM Sterling Control Center and as part of dependency one of them is in spring-web-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47883 DESCRIPTION: UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38816 CVE-2024-38816 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38816 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

CVE-2026-47883

CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC Ce dépôt est un PoC de reproduction minimale de CVE-2026-47883, publié dans l'avis de sécurité officiel de Spring. Avis officiel : https://spring.io/security/cve-2026-47883/ Titre officiel : Spring Framework Open Redirect in...

Security Bulletin: Vulnerability reported in jackson-core-2.18.6.jar for APIM 11.1 is now addressed

Summary Vulnerability reported in jackson-core-2.18.6.jar for APIM 11.1 is now addressed Vulnerability Details CVEID:CVE-2026-68494 DESCRIPTION: The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser is...

cve-2024-38819

CVE-2024-38819 01. File-Traversal and Webflux Overview 1 File-Traversal and WebFlux Overview File-Traversal Path Traversal vulnerability allows an attacker to bypass file system permissions in a web application and access arbitrary files, and is a type of attack designated as CWE-22. Spring...