ROOT-APP-MAVEN-CVE-2026-41844 CVE-2026-41844 in io.root.org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-41844 in the io.root.org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41845 CVE-2026-41845 in io.root.org.springframework:spring-core - Patched by Root

Root has patched CVE-2026-41845 in the io.root.org.springframework:spring-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22745 CVE-2026-22745 in io.root.org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-22745 in the io.root.org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22741 CVE-2026-22741 in io.root.org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-22741 in the io.root.org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41001 CVE-2026-41001 in io.root.org.springframework.boot:spring-boot - Patched by Root

Root has patched CVE-2026-41001 in the io.root.org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40992 CVE-2026-40992 in io.root.org.springframework.boot:spring-boot-autoconfigure - Patched by Root

Root has patched CVE-2026-40992 in the io.root.org.springframework.boot:spring-boot-autoconfigure package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40976 CVE-2026-40976 in io.root.org.springframework.boot:spring-boot - Patched by Root

Root has patched CVE-2026-40976 in the io.root.org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available...

K000162041: Spring Framework vulnerabilities CVE-2026-41843 and CVE-2026-41846

Security Advisory Description CVE-2026-41843 Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48. CVE-2026-41846 Spri...

CVE-2026-41001

A flaw was found in Spring Boot. The ArtemisEmbeddedConfigurationFactory component uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can exploit this by pre-creating this predictable directory ...

CVE-2026-41721

A flaw was found in Spring Data Commons. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request when Spring Data Web Support is enabled with a Controller method using @ProjectedPayload. This can cause the application to allocate excessive memory, leading to a...

ROOT-APP-MAVEN-CVE-2026-40991 CVE-2026-40991 in io.root.org.springframework.restdocs:spring-restdocs-restassured - Patched by Root

Root has patched CVE-2026-40991 in the io.root.org.springframework.restdocs:spring-restdocs-restassured package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41701 CVE-2026-41701 in io.root.org.springframework.amqp:spring-amqp - Patched by Root

Root has patched CVE-2026-41701 in the io.root.org.springframework.amqp:spring-amqp package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41714 CVE-2026-41714 in io.root.org.springframework.amqp:spring-amqp - Patched by Root

Root has patched CVE-2026-41714 in the io.root.org.springframework.amqp:spring-amqp package for Root:Maven. Multiple fixed versions available...

CVE-2026-40989

A flaw was found in Spring Cloud Function. An attacker could send a specially crafted request that triggers infinite recursion in the routing layer. This can lead to an Out Of Memory OOM error, causing a Denial of Service DoS condition where the application becomes unresponsive...

CVE-2026-40987

A flaw was found in Spring Integration. A malicious or compromised FTP File Transfer Protocol, SFTP SSH File Transfer Protocol, or SMB Server Message Block server can exploit this vulnerability. This allows the server to write arbitrary files with attacker-controlled content to any location on th...

This Week in Spring - June 30th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring , a weekly recap in which we review the latest and greatest in the wide and wonderful world of Spring. You probably already knew this. I don't know if I needed to mention it. But I like to. I've been doing this every week,...

CVE-2026-41696

A flaw was found in Spring Data MongoDB. Repository query methods that use regular expression regex parameter binding perform insufficient validation of the bound parameter. A remote attacker can exploit this by supplying a crafted string, which could lead to breaking out of the intended regular...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: syft-fips, podman, crossplane-provider-aws-memorydb, crossplane-provider-aws-sqs, fulcio, crossplane-provider-aws-elasticsearch, trivy-fips, crossplane-provider-aws-eks, amazon-ssm-agent, skaffold-fips, terraform, crossplane-provider-aws-chime-fips, cloudbeat-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: syft-fips, podman, crossplane-provider-aws-memorydb, crossplane-provider-aws-sqs, fulcio, crossplane-provider-aws-elasticsearch, trivy-fips, crossplane-provider-aws-eks, amazon-ssm-agent, skaffold-fips, terraform, crossplane-provider-aws-chime-fips, cloudbeat-fips,...

Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Denial of Service (Dos) attacks, and Incorrect Authorization attacks

Summary IBM Terracotta uses Spring Framework as an application foundation within the product. Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. By...