CVE-2026-47859: Allocation of Resources Without Limits or Throttling

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring...

CVE-2026-47886: Uncontrolled Resource Consumption

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

CVE-2026-47888: Missing Release of Memory after Effective Lifetime

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE...

CVE-2026-47885: Allocation of Resources Without Limits or Throttling

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

CVE-2026-59355: URL Redirection to Untrusted Site

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

PT-2026-82697

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 2.0.0 through 2.0.4 Spring for GraphQL versions 1.4.0 through 1.4.6 Spring for GraphQL versions 1.1.0 through 1.3.9 Spring for GraphQL versions 1.0.0 through 1.0.7 Description The GraphiQL page loads JavaScript...

PT-2026-82397

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...

CVE-2026-59314: Improper Neutralization of CRLF Sequences in HTTP Headers

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

CVE-2026-59281: Improper Neutralization of Input During Web Page Generation

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-59301: Insertion of Sensitive Information into Log File

Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-59322: Improper Input Validation

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...

PT-2026-82696

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4...

PT-2026-82721

DeadLetterPublishingRecovererFactory reads the retry topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigIntegerheader.value with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for...

CVE-2026-47877: Improper Neutralization of Input During Web Page Generation

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

CVE-2026-47862: Improper Limitation of a Pathname to a Restricted Directory

An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...

PT-2026-82710

Name of the Vulnerable Software and Affected Versions Spring Cloud Stream versions 5.0.0 through 5.0.2 Spring Cloud Stream versions 4.3.0 through 4.3.3 Spring Cloud Stream versions 4.2.0 through 4.2.6 Description There is a potential for the application to log sensitive data within the framework...

PT-2026-82704

Name of the Vulnerable Software and Affected Versions Spring AI versions 1.0.0 through 1.0.9 Spring AI versions 1.1.0 through 1.1.8 Spring AI version 2.0.0 Description The getCacheName function in ResourceCacheService creates on-disk filenames by appending the URI fragment without removing path...

CVE-2026-59278: Server-Side Request Forgery (SSRF)

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the...

PT-2026-82399

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json TypeId which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration...

PT-2026-82702

Name of the Vulnerable Software and Affected Versions Spring Integration version 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier Description The...