CVE-2018-1270

CVE-2018-1270 - Spring Messaging SpEL Code Execution Vulnerability Yesterday, Spring disclosed an RCE vulnerability. Take a look: CVE-2018-1270: Remote Code Execution with spring-messaging Affected Versions Spring Framework 5.0 to 5.0.4 Spring Framework 4.3 to 4.3.14 This vulnerability does not...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +9988 more potentially affected by CVE-2026-47888 via org.springframework:spring-messaging (>=5.2.0.release, <=7.0.8)

org.springframework:spring-messaging MAVEN version =5.2.0.release, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.1, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.9.2 and more Source cves: CVE-2026-47888 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267440https://vulners.com/snyk...

Missing Release of Resource after Effective Lifetime

Overview org.springframework:spring-messaging is a framework and inversion of control container for the Java platform. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the RSocketMessageHandler process when handling a malformed SETUP...

CVE-2026-41714

Spring AMQP 2.4.x/3.1.x/3.2.x/4.0.x (versions 2.4.0–2.4.17, 3.1.0–3.1.15, 3.2.0–3.2.10, 4.0.0–4.0.3) are affected by CVE-2026-41714. The issue occurs when a broker connection is configured via RabbitConnectionFactoryBean.setUri("amqps://...") without calling setUseSSL(true). This leads to TLS enc...

A Bootiful Podcast: Spring Messaging Legend Soby Chacko

Hi, Spring fans! In this installment, we talk with the legendary Soby Chacko about Apache Kafka, Spring AI, and much more! apachekafka kafka...

SUSE CVE-2018-1270

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

Denial Of Service (DoS)

spring-messaging is vulnerable to denial of service. The vulnerability exists because the handleMessageInternal function of SimpleBrokerMessageHandler.java does not properly handle to ignore the invalid STOMP frames, allowing an attacker to cause an application crash through the WebSocket endpoin...

ch.rasc:wampspring (1.1.1), ch.rasc:wampspring-security (1.1.1) +144 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.1.6.release)

org.springframework:spring-messaging MAVEN version 4.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - ch.rasc:wampspring 1.1.1 - ch.rasc:wampspring-security 1.1.1 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +40 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.0.release)

org.springframework:spring-messaging MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

br.jus.stf.digital:core (>=2.0.0, <=2.3.1), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.4, <=2.5) +325 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.7.release)

org.springframework:spring-messaging MAVEN version 4.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - br.jus.stf.digital:core =2.0.0, =2.4, =1.1.0, =1.1.0, =1.0.1-release,...

at.researchstudio.sat:won-core (>=0.2, <=0.3), at.researchstudio.sat:won-cryptography (0.3) +313 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.8.release)

org.springframework:spring-messaging MAVEN version 4.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - at.researchstudio.sat:won-core =0.2, =0.2, =0.2, =0.2, =0.2, =0.3 and more Sour...

ai.superstream:spring-kafka (>=2.8.4-alpha1, <=2.8.4-alpha6), biz.eyebeam.mssc:mssc-public-bom (>=1.0.1, <=1.0.5) +2369 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (>=5.3.0, <=5.3.19)

org.springframework:spring-messaging MAVEN version =5.3.0, =2.8.4-alpha1, =1.0.1, =1.0.3, =0.0.1-alpha, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =5.6.5, =5.6.5, =5.3.0, =5.6.5, =5.3.0, =5.3.0, =6.0.5 and more Source cves: CVE-2022-22971 Source advisory: OSV:GHSA-RQPH-VQWM-22VC...

com.kurento.kmf:kmf-broker (4.3.1), net.gplatform:sudoor-server-lib (>=1.0.4, <=1.0.12) +49 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.0.6.release)

org.springframework:spring-messaging MAVEN version 4.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.kurento.kmf:kmf-broker 4.3.1 - net.gplatform:sudoor-server-lib =1.0.4,...

at.chrl:chrl-jms (1.1.0), com.ahome-it:ahome-tooling-server-core (>=1.0.110-release, <=1.0.120-release) +71 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.2.1.release)

org.springframework:spring-messaging MAVEN version 4.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - at.chrl:chrl-jms 1.1.0 - com.ahome-it:ahome-tooling-server-core =1.0.110-releas...

com.github.zed-platform:zed-service-messagestore-attachment (0.0.20), com.northstrat:springsecurity3-websockets (0.1) +53 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.1.5.release)

org.springframework:spring-messaging MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.github.zed-platform:zed-service-messagestore-attachment 0.0.20 -...

at.researchstudio.sat:won-core (>=0.4, <=0.9), at.researchstudio.sat:won-cryptography (>=0.4, <=0.6) +444 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.18.release)

org.springframework:spring-messaging MAVEN version 4.3.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - at.researchstudio.sat:won-core =0.4, =0.4, =0.4, =0.4, =0.4, =0.4, =0.4, =0.4,...

de.mhus.app.vault:vault-playground-assembly (>=7.2.0, <=7.3.0), de.mhus.cherry.vault:vault-playground-assembly (7.1.0) +45 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.26.release)

org.springframework:spring-messaging MAVEN version 4.3.26.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - de.mhus.app.vault:vault-playground-assembly =7.2.0, =7.1.0, =7.1.0, =7.1.0,...

com.fnproject.fn:fn-spring-cloud-function (>=1.0.70, <=1.0.109), com.gitee.qdbp:qdbp-general-ctl (>=3.3.0, <=3.4.2) +324 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.17.release)

org.springframework:spring-messaging MAVEN version 4.3.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.fnproject.fn:fn-spring-cloud-function =1.0.70, =3.3.0, =3.3.10, =3.3.10,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), com.ahome-it:ahome-tooling-server-core (>=1.1.4-release, <=1.1.9-release) +58 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.1.release)

org.springframework:spring-messaging MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =1.1.4-release, =1.1.4-release,...

org.springframework.boot:spring-boot-starter-integration (>=1.1.9.release, <=1.1.10.release), org.springframework.integration:spring-integration-amqp (>=4.0.6.release, <=4.0.7.release) +27 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.0.8.release)

org.springframework:spring-messaging MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.springframework.boot:spring-boot-starter-integration =1.1.9.release,...