Denial-of-service (DoS)

Spring Cloud Sleuth is vulnerable to a Denial-of-service DoS. The vulnerability is due to specially crafted calls that can trigger a DoS condition when org.springframework.cloud:spring-cloud-sleuth-instrumentation is used with Spring TX instrumentation enabled, allowing an attacker to exploit the...

CLSA-2026-1786623881 TuxCare security update for org.springframework (9 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 9 CVEs. Fixed in 6.0.16-tuxcare.5...

CVE-Web-Framework

Web Framework CVE Vulnerability Reproduction Testbed Warn...

CLSA-2026-1786606429 TuxCare security update for org.springframework (5 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 5 CVEs. Fixed in 5.3.31-tuxcare.10...

Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench

Summary Multiple vulnerabilities were addressed in IBM DevOps Solution Workbench version 5.2.1 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. By...

CLSA-2026-1786599882 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.15-tuxcare.3...

CLSA-2026-1786598361 TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 3 CVEs. Fixed in 4.3.30.RELEASE-tuxcare.6...

CLSA-2026-1786568979 TuxCare security update for org.springframework.hateoas:spring-hateoas (1 CVE)

TuxCare rebuilt org.springframework.hateoas:spring-hateoas to address 1 CVE. Fixed in 2.4.1-tuxcare.1...

CLSA-2026-1786563390 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.2.7-tuxcare.3...

K000162895: Spring Framework CookieRequestCache vulnerability CVE-2026-41706

Security Advisory Description Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is...

CLSA-2026-1786555755 TuxCare security update for org.springframework (10 CVEs)

TuxCare rebuilt 26 org.springframework packages to address 10 CVEs. Fixed in 6.1.7-tuxcare.2...

K000162894: Spring Data Relational vulnerability CVE-2026-41697

Security Advisory Description Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher STARTING, ENDING, or CONTAINING in Query By Example QBE. An attacker can supply wildcard characters to perform boolean-based blind data inference...

K000162893: Spring Web Services vulnerability CVE-2026-40995

Security Advisory Description X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks disabled, locked, expired, or credentials-expired accounts...

CLSA-2026-1786552823 TuxCare security update for org.springframework (10 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 10 CVEs. Fixed in 5.3.7-tuxcare.5...

CLSA-2026-1786547487 TuxCare security update for org.springframework.pulsar (3 CVEs)

TuxCare rebuilt 6 org.springframework.pulsar packages to address 3 CVEs. Fixed in 1.2.13-tuxcare.1...

CLSA-2026-1786547094 TuxCare security update for org.springframework.data:spring-data-ldap (3 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 3 CVEs. Fixed in 3.2.12-tuxcare.1...

CLSA-2026-1786543288 TuxCare security update for org.springframework.ws (2 CVEs)

TuxCare rebuilt 6 org.springframework.ws packages to address 2 CVEs. Fixed in 3.1.6-tuxcare.1...

CLSA-2026-1786536841 TuxCare security update for org.springframework.data (3 CVEs)

TuxCare rebuilt 5 org.springframework.data packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.1...

Security Bulletin: Multiple Vulnerabilities in watsonx.data

Summary Multiple vulnerabilities were addressed in watsonx.data 2.3.1 patch 6 version, which was present in different version from watson.data 2.3.1 to watsonx.dat 2.3.1 Patch 5 Vulnerability Details CVEID:CVE-2026-22741 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to cache...

Security Bulletin:Vulnerability in Spring Framework affects IBM Netezza Appliance

Summary The Spring Framework package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-41854 Vulnerability Details CVEID:CVE-2026-41854 DESCRIPTION: Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate ...