com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (>=5.0.0-m1, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0-m1, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41730 Source advisory: SNYK:JAVA-ORGS...

Information Exposure

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Information Exposure. in the error response serialization. An attacker can gain access to sensitive internal information by triggering errors that cause the full...

Access Control Bypass

Overview org.springframework.data:spring-data-rest-core is a Spring Data REST. Affected versions of this package are vulnerable to Access Control Bypass. in the Querydsl integration, which accepts arbitrary persistent property paths as request-parameter filter keys without considering Jackson...

Access Control Bypass

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Access Control Bypass in the Querydsl integration, which accepts arbitrary persistent property paths as request-parameter filter keys...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the retrytopic-attempts header. An attacker can manipulate retry routing and backoff behavior by sending crafted headers with out-of-range attempt counts. Remediation Upgrade...

Denial of Service (DoS)

Overview org.springframework.data:spring-data-commons is a maven plugin to centralize common resources and configuration for Spring Data Maven builds. Affected versions of this package are vulnerable to Denial of Service DoS via data binding. An attacker can exhaust system memory resources by...

app.tozzi:jpa-search-helper (>=3.6.0, <=4.0.0), be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9) +2374 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (>=4.0.0-m1, <=4.0.5)

org.springframework.data:spring-data-commons MAVEN version =4.0.0-m1, =3.6.0, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.0, =0.5.0, =0.2.0, =1.0.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41721 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKDATA-17279540...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.1.1, <=0.120.0) +9187 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (>=3.0.0, <=3.5.11)

org.springframework.data:spring-data-commons MAVEN version =3.0.0, =0.1.0, =0.1.1, =0.7.9, =0.6.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-41721 Source advisory:...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the DelegatingDeserializer function. An attacker can exhaust system memory by sending records with unique, random spring.kafka.serialization.selector header values, leading to...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +173 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (>=4.0.0-m2, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0-m2, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +660 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (>=3.0.0, <=3.3.15)

org.springframework.kafka:spring-kafka MAVEN version =3.0.0, =cloud-0.1, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.1.0, =0.1.0, =0.1.0, =3.6.0, =1.0.0, =2.2.1, =6.10.0 and more Source cves: CVE-2026-41726 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKKAFKA-17279506...

fr.xebia.springframework:xebia-spring-security-extras (>=1.1.4, <=1.1.6), org.appfuse:appfuse-jsf (2.1.0-m2) +27 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.0.4.release)

org.springframework.security:spring-security-web MAVEN version 3.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - fr.xebia.springframework:xebia-spring-security-extras...

com.keyholesoftware:khs-sherpa-spring (>=1.2.0, <=1.2.1), org.codehaus.spring-security-oauth:spring-security-oauth (>=3.9.ss3, <=3.11.ss3) +9 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.0.0.release)

org.springframework.security:spring-security-web MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.keyholesoftware:khs-sherpa-spring =1.2.0, =3.9.ss3,...

cc.chensoul.nacos:nacos-distribution (2.5.2), com.buession.security:buession-security-spring (>=3.0.0, <=3.0.1) +588 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-web MAVEN version =5.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.11.0, =5.11.0, =1.48.0, =1.48.0, =1.48.0, =2.4.0, =2.4.0, =2.4.0, =4.5.0, =4.5.0, =4.5.1 and more Source cves: CVE-2026-47838 Source advisory: OSV:GHSA-293Q-567P-WMWQ...

be.looorent:spring-security-jwt (>=0.1, <=0.8), br.jus.stf.digital:core (0.1.0) +48 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.1.1.release)

org.springframework.security:spring-security-web MAVEN version 4.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - be.looorent:spring-security-jwt =0.1, =1.0.0-rc, =0.5.0...

org.pac4j:spring-security-pac4j (>=1.2.3, <=1.2.4), org.springframework.security:spring-security-cas (3.2.2.release) +3 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.2.2.release)

org.springframework.security:spring-security-web MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.pac4j:spring-security-pac4j =1.2.3, =1.2.4 -...

com.github.waffle.demo:waffle-spring-filter (2.3.0), com.github.waffle.demo:waffle-spring-form (2.3.0) +41 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.2.17.release)

org.springframework.security:spring-security-web MAVEN version 4.2.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.github.waffle.demo:waffle-spring-filter 2.3.0 -...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +90 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.2.5.release)

org.springframework.security:spring-security-web MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1,...

com.github.cwilper.fcrepo-cloudsync:fcrepo-cloudsync-service (>=1.0.0-beta-1, <=1.0.0), com.github.lltyk:tapestry-spring-security (>=3.0.2, <=3.0.3) +128 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.0.5.release)

org.springframework.security:spring-security-web MAVEN version 3.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: -...

GHSA-293Q-567P-WMWQ Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

In Spring Security Web, SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user...