A Bootiful Podcast: Spring Boot founder and lead Phil Webb

Hi, Spring fans! In this installment I talk to Spring Boot cofounder Phil Webb who joins the show to unpack the latest Spring Boot 4.1 release, from the long-awaited Spring gRPC support and MongoDB batch starter to security, observability, service connections, and other polished improvements...

cve-2026-59326 - LOW - CVE-2026-59326: HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server

The Spring Boot language server logs the raw value of the httpsproxy / HTTPSPROXY / httpproxy / HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth...

cve-2026-59327 - MEDIUM - CVE-2026-59327: Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

cve-2026-47858 - HIGH - CVE-2026-47858: live information startup mode is vulnerable for remote code execution

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. This affects the live information feature across all environments Eclipse, Visual Studio Code, Theia, Cursor except the...

cve-2026-59328 - MEDIUM - CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

Exploit for CVE-2026-16723

Fastjson 1.2.83 RCE Lab Environment CVE-2026-16723 Disc...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Boot [CVE-2026-40992, CVE-2026-41001]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Boot due to flaws in Mail auto-configuration and ArtemisEmbeddedConfigurationFactory CVE-2026-40992, CVE-2026-41001. Spring Boot is used as part of our microservices. These vulnerabilities have been addressed...

Spring Office Hours Podcast: S5E19 - Docker, Compose, Testcontainers, Oh My!

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun will discuss some of the new features around Docker, Testcontainers and the Spring Boot plugin. You can participate in our live stream to ask questions or catch the replay on your...

Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available

Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-1672...

Imperva Customers Protected Against CVE-2026-16723: Critical FastJson 1.x Zero-Day RCE

TL;DR:A critical remote code execution vulnerability has been disclosed in FastJson, a widely used JSON processing library for Java. The vulnerability, assigned CVE-2026-16723 with a CVSS score of 9.0 Critical, affects FastJson versions 1.2.68 through 1.2.83 under specific Spring Boot deployment...

Deserialization of Untrusted Data

Overview com.alibaba:fastjson is a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the JSON parsing path in JSON.parse, JSON.parseObjectString, and JSON.parseObjectString, Class when it runs inside a Spring Boot...

CLEANSTART-2026-ZG11653 Security fixes for ghsa-4265-ccf5-phj5, ghsa-4g9r-vxhx-9pgx applied in versions: 3.4.13-r0

Multiple security vulnerabilities affect the spring-boot package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JI44198 Security fixes for ghsa-j288-q9x7-2f5v applied in versions: 3.5.13-r0

Security vulnerability affects the spring-boot package. This issue is resolved in later releases. See references for vulnerability details...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

yaml-payload A SnakeYAML deserialization exploit payload for...

vulnerable-web-app

vulnerable-web-app ⚠️ Intentionally vulnerable. A runna...

The vulnerability of the Micrometer library in the Spring Boot web application framework allows a attacker to cause a service failure.

The vulnerability of the Micrometer library in the Spring Boot web application framework is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending specially crafted HTTP requests...

The vulnerability of the Micrometer library in the Spring Boot web application framework allows a attacker to cause a service failure.

The vulnerability of the Micrometer library in the Spring Boot web application framework is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending specially crafted gRPC requests...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway for Multiplatforms due to the use of Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring Context, Spring Beans and Logback Core. The Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway Desktop Edition due to the use of Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring Context, SnakeYAML, Spring Beans, Logback Classic and Logback Core. The Apache Tomcat Embed, Spring Web MVC, Spring...

EUVD-2026-43556

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...