PT-2026-66787

Security vulnerability affects the spring-boot package. This issue is resolved in later releases. See references for vulnerability details...

This Week in Spring - July 21st, 2026

Welcome to another installment of This Week in Spring! I'm writing this while enjoying a cup of coffee from the Caribbean on a little PTO. How're you doin'? Whenever I go on PTO, I like to sit by some body of water with a coffee and a laptop nearby. I alternate between plunges in the ocean and...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0) potentially affected by CVE-2026-67317 via org.webjars.npm:axios (1.7.2)

org.webjars.npm:axios MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:axios and may be impacted: - com.github.linyuzai:concept-plugin-spring-boot-starter =2.0.0, =3.0.0 Source cves: CVE-2026-67317 Source advisory:...

Improper Isolation or Compartmentalization

Overview Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization due to the GroovySandboxScriptEngineImpl implementation in the core/spring module. An administrator with the entitlements to manage Implementations can supply a malicious Groovy class that...

CVE-2026-41855

A flaw was found in Spring Framework. In an untrusted Java Message Service JMS environment, the MappingJackson2MessageConverter and JacksonJsonMessageConverter components allow for arbitrary class instantiation. This vulnerability can be exploited by a remote attacker through gadget class...

CVE-2026-41849

A flaw was found in the Spring Expression Language SpEL within the Spring Framework. An integer overflow vulnerability allows a remote attacker to supply a specially crafted SpEL expression. This can trigger excessive resource consumption, leading to a Denial of Service DoS condition. Mitigation...

K000162344: Spring framework vulnerability CVE-2026-41003

Security Advisory Description An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through...

K000162341: Multiple Spring framework vulnerabilities

Security Advisory Description CVE-2026-41837 Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19;...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

Sean's Surf & Skate Co. — Seal Security Demo Maven / Java A...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

yaml-payload A SnakeYAML deserialization exploit payload for...

K000162321: Spring Framework vulnerability CVE-2026-41699

Security Advisory Description Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated Connection field and...

K000162319: Spring Framework vulnerability CVE-2026-41854

Security Advisory Description Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery SSRF attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through...

CVE-2026-41845

A flaw was found in Spring Framework. Due to incorrect escaping when using JavaScriptUtils.javaScriptEscape, a remote attacker could inject malicious JavaScript code into a user's browser. This could lead to a cross-site scripting XSS vulnerability, allowing the attacker to execute arbitrary...

CVE-2026-41839

A flaw was found in Spring Framework. A remote attacker, by compromising a subdomain of a WebFlux application for example, through cross-site scripting XSS, could exploit this vulnerability to escalate privileges. This allows the attacker to exchange a known session ID for that of an authenticate...

CVE-2026-41844

A flaw was found in Spring Framework. A Spring MVC or Spring WebFlux application that configures a mapping for "/" without explicitly specifying the view name is vulnerable. An attacker can exploit this by crafting a malicious link, leading to an open redirect. This allows the attacker to redirec...

CVE-2026-41850

A flaw was found in Spring Framework. Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. A remote attacker can exploit this by providing a specially crafted expression, which triggers excessive resource...

CVE-2026-41853

A flaw was found in Spring MVC and WebFlux applications, components of the Spring Framework. This vulnerability allows a remote, unauthenticated attacker to perform Multipart request smuggling attacks. Such an attack can lead to a low integrity impact, potentially enabling the attacker to bypass...

CVE-2026-41851

A flaw was found in Spring Framework. Applications that accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack. This occurs if the evaluation of a SpEL expression triggers unbounded cache growth, consuming excessive resources and makin...

CVE-2026-41848

A flaw was found in Spring Framework. A remote attacker can exploit this vulnerability by providing a specially crafted regular expression pattern to the AntPathMatcher component. This can lead to a Regular Expression Denial of Service ReDoS condition, causing the application to become...

CVE-2026-41842

A flaw was found in the Spring Framework. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exploiting how Spring MVC and WebFlux applications resolve static resources. This can lead to the affected application becoming unavailable. Mitigation Mitigation for this iss...