io.quarkus:quarkus-spring-web-deployment (>=3.33.0, <=3.33.3.1) potentially affected by CVE-2026-19651 via io.quarkus:quarkus-spring-web (>=3.33.0, <=3.33.3.1)

io.quarkus:quarkus-spring-web MAVEN version =3.33.0, =3.33.0, =3.33.3.1 Source cves: CVE-2026-19651 Source advisory: MEND:CVE-2026-19651...

io.quarkus:quarkus-spring-web-deployment (>=3.34.0, <=3.39.1) potentially affected by CVE-2026-19651 via io.quarkus:quarkus-spring-web (>=3.34.0, <=3.39.1)

io.quarkus:quarkus-spring-web MAVEN version =3.34.0, =3.34.0, =3.39.1 Source cves: CVE-2026-19651 Source advisory: MEND:CVE-2026-19651...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Spring Web integration, Qute, OIDC, RESTEasy and SmallRye GraphQL Vulnerability Details CVEID:CVE-2026-19651 DESCRIPTION: Quarkus quarkus-spring-web extension could allow an attacker to bypass authorization by manipulating...

No title provided

A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources...

No title provided

A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources...

CVE-2026-19651

A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources. Mitigation...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6813 more potentially affected by CVE-2026-59314 via org.springframework:spring-web (>=7.0.0, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-59314 Source advisory: MEND:CVE-2026-59314...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6813 more potentially affected by CVE-2026-59281 via org.springframework:spring-web (>=7.0.0, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-59281 Source advisory: MEND:CVE-2026-59281...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6813 more potentially affected by CVE-2026-47889 via org.springframework:spring-web (>=7.0.0, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-47889 Source advisory: MEND:CVE-2026-47889...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6813 more potentially affected by CVE-2026-47885 via org.springframework:spring-web (>=7.0.0, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-47885 Source advisory: MEND:CVE-2026-47885...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6813 more potentially affected by CVE-2026-47883 via org.springframework:spring-web (>=7.0.0, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-47883 Source advisory: MEND:CVE-2026-47883...

K000163048: Spring web services vulnerability CVE-2026-40998

Security Advisory Description Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that...

Cross-site Scripting (XSS)

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the...

Allocation of Resources Without Limits or Throttling

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...

HTTP Response Splitting

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to HTTP Response Splitting via the...

Sensitive Cookie in HTTPS Session Without "Secure" Attribute

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +20463 more potentially affected by CVE-2026-47885 via org.springframework:spring-web (>=6.1.0, <=7.0.8)

org.springframework:spring-web MAVEN version =6.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.0.1, =0.1.4 and more Source cves: CVE-2026-47885 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267077...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +15279 more potentially affected by CVE-2026-47889 via org.springframework:spring-web (>=6.2.0, <=7.0.8)

org.springframework:spring-web MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.5.7 and more Source cves: CVE-2026-47889 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267079...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6854 more potentially affected by CVE-2026-59314 via org.springframework:spring-web (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-59314 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267076...

ai.astraform:remote-domain-author-kit-java (0.2.0), ai.astraform:remote-domain-conformance-java (0.2.0) +6854 more potentially affected by CVE-2026-59281 via org.springframework:spring-web (>=7.0.0-m1, <=7.0.8)

org.springframework:spring-web MAVEN version =7.0.0-m1, =0.1.0, =0.0.1, =0.0.1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =0.1.0, =0.1.0, =1.8.1 and more Source cves: CVE-2026-59281 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267078...