CVE-2026-41708

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service DoS condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is...

CVE-2026-47825 Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x fix 3.1.13. Spring Cloud Gateway 4.1.x fix 4.1.13. Spri...

CVE-2026-47825

The CVE affects Spring Cloud Gateway Server components (WebMVC and WebFlux gateways) where headers from untrusted proxies (X-Forwarded-For, Forwarded) are forwarded in certain configurations. Root cause: forwarded-header handling without a trusted-proxy basis allows forged headers to reach downst...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-boot-3.5.13.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-40973, CVE-2026-40975, CVE-2026-40977. Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the directory used by...

CVE-2026-41708 Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service DoS condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is...

CVE-2026-41708

The CVE describes a DoS vulnerability in Spring Cloud Sleuth via the Spring TX instrumentation when using vulnerable versions of org.springframework.cloud:spring-cloud-sleuth-instrumentation (SLEUTH 3.1.0–3.1.13). The root cause is exposure of the transaction instrumentation to crafted calls, all...

CVE-2026-41708 Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service DoS condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is...

CVE-2026-47835 Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-admin (1.0.0.4), com.alibaba.cloud.ai:spring-ai-alibaba-studio-server-core (1.0.0.4) +2 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: MEND:CVE-2026-47835...

ai.koog:koog-spring-ai-starter-vector-store (>=0.8.0-rc-1, <=1.3.0-beta), ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6) +306 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-vector-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-vector-store MAVEN version =1.1.0, =0.8.0-rc-1, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =25.4.0, =1.21.2, =0.1.0, =0.3.0, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.2.4-security-fix and more Source cves: CVE-2026-47835 Source advisory: MEND:CVE-2026-47835...

com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-rag-elasticsearch (>=1.1.0.0-rc1, <=1.1.2.4-security-fix), com.alibaba.cloud.ai:spring-ai-alibaba-rag (>=1.1.0.0-rc1, <=1.1.2.4-security-fix) +6 more potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-elasticsearch-store (>=1.1.0, <=1.1.7)

org.springframework.ai:spring-ai-elasticsearch-store MAVEN version =1.1.0, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0.0-rc1, =1.1.0, =1.1.7 Source cves: CVE-2026-47835 Source advisory: MEND:CVE-2026-47835...

org.springframework.ai:spring-ai-starter-vector-store-gemfire (>=1.0.0, <=1.0.8) potentially affected by CVE-2026-47835 via org.springframework.ai:spring-ai-gemfire-store (>=1.0.0, <=1.0.8)

org.springframework.ai:spring-ai-gemfire-store MAVEN version =1.0.0, =1.0.0, =1.0.8 Source cves: CVE-2026-47835 Source advisory: MEND:CVE-2026-47835...

XXE Injection

Spring REST Docs is vulnerable to XML External Entity XXE Injection. The vulnerability is due to unsafe processing of XML content when documenting remote APIs, where a compromised or malicious API can supply crafted XML containing external entities. When documentation-generating tests are execute...

PT-2026-49304

Name of the Vulnerable Software and Affected Versions Spring Cloud Sleuth versions 3.1.0 through 3.1.13 Description A denial-of-service DoS condition can be triggered when a user provides specially crafted calls. This occurs in applications using the...

CVE-2026-47825: Origin Validation Error

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x fix 3.1.13. Spring Cloud Gateway 4.1.x fix 4.1.13. Spri...

CVE-2026-41708: Uncontrolled Resource Consumption

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service DoS condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is...

CVE-2026-47835: Improper Neutralization of Special Elements in Data Query Logic

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

Tool Calling in Spring AI 2.0: A Composable, Agentic Architecture

Tool calling — the ability for an AI model to invoke application-defined functions and act on the results — is the essential building block of agentic AI systems. A model that can discover information, take action, and loop until a goal is reached is an agent. Spring AI 2.0 rearchitects tool...

Unsafe Deserialization

Spring for Apache Kafka is vulnerable to an unsafe deserialization. The vulnerability is due to improper trusted-package matching in JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper, where prefix-based checks implicitly trusted subpackages and, combined with Jackson's default bea...

Improper Authorization org.springframework.security:spring-security-core Dependency in Crucible Data Center and Server

This High severity Improper Authorization vulnerability was introduced in version 4.9.0 of Crucible Server. This Improper Authorization vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N allows an unauthenticated attacker to gain unintended...