PT-2026-48613

Name of the Vulnerable Software and Affected Versions Spring Web Flow version 4.0.0 Spring Web Flow versions 3.0.0 through 3.0.1 Spring Web Flow versions 2.5.0 through 2.5.1 Description Applications that configure the WebFlowELExpressionParser are susceptible to the use of malicious Unified EL...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Spring TX transaction instrumentation classes in this package. A remote user can issue calls that drive the transaction instrumentation to allocate resources without limits or...

cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability...

PT-2026-48617

Name of the Vulnerable Software and Affected Versions Spring Web Services versions 5.0.0 through 5.0.1 Spring Web Services versions 4.1.0 through 4.1.3 Spring Web Services versions 4.0.0 through 4.0.18 Spring Web Services versions 3.1.0 through 3.1.8 Description The Wss4jSecurityInterceptor...

org.springframework.statemachine:spring-statemachine-cluster (>=4.0.0, <=4.0.1), org.springframework.statemachine:spring-statemachine-samples-web (4.0.0) +1 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-zookeeper (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-zookeeper MAVEN version =4.0.0, =4.0.0, =4.0.1 - org.springframework.statemachine:spring-statemachine-samples-web 4.0.0 - org.springframework.statemachine:spring-statemachine-samples-zookeeper 4.0.0 Source cves: CVE-2026-41862 Source advisory:...

VMware Spring Boot security vulnerabilities

VMware Spring Boot is an open-source framework developed by the American company VMware. There are security vulnerabilities in versions 4.0.0 to 4.0.6, 3.5.0 to 3.5.14, 3.4.0 to 3.4.16, 3.3.0 to 3.3.19, and 2.7.0 to 2.7.33 of VMware Spring Boot. These vulnerabilities stem from the use of fixed...

PT-2026-80277

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

CVE-2026-41001: Insecure Temporary File

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

org.springframework.statemachine:spring-statemachine-samples-datapersist (4.0.0), org.springframework.statemachine:spring-statemachine-samples-eventservice (4.0.0) potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-data-redis (4.0.0)

org.springframework.statemachine:spring-statemachine-data-redis MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.statemachine:spring-statemachine-data-redis and may be impacted: -...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), guru.nicks.commons:statemachine-starter (>=100.260315.1, <=100.260611.0) +3 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-data-jpa (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-data-jpa MAVEN version =4.0.0, =0.0.1, =100.260315.1, =100.260611.0 - org.springframework.statemachine:spring-statemachine-samples-datajpa 4.0.0 - org.springframework.statemachine:spring-statemachine-samples-datajpamultipersist 4.0.0 -...

PT-2026-48624

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.6 Spring Boot versions 3.5.0 through 3.5.14 Spring Boot versions 3.4.0 through 3.4.16 Spring Boot versions 3.3.0 through 3.3.19 Spring Boot versions 2.7.0 through 2.7.33 Description The...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), com.brihaspathee.zeus:account-processor (>=1.0.4, <=1.0.9) +41 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-core (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-core MAVEN version =4.0.0, =0.0.1, =1.0.4, =1.0.3, =1.1.0, =100.260315.1, =2025.02, =2025.02, =2025.02, =2024.12.24, =2024.12.24, =4.0.0, =4.0.0, =4.0.0, =4.0.1 and more Source cves: CVE-2026-41862 Source advisory: SNYK:JAVA-ORGSPRING...

VMware Spring for GraphQL code issues and vulnerabilities

VMware Spring for GraphQL is a GraphQL application development framework provided by the American company VMware. Versions of VMware Spring for GraphQL such as 2.0.0, 1.4.0, and 1.3.0 contain code vulnerabilities. These vulnerabilities stem from insecure deserialization during the processing of...

Deserialization of Untrusted Data

Overview org.springframework.statemachine:spring-statemachine-core is a Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The Kryo-based persistence serializers KryoStateMachineSerialisationService / AbstractKryoStateMachineSerialisationService deserialise...

cve-2026-41862 - HIGH - Kryo deserialization of persisted context without class allowlist

cve-2026-41862 - HIGH - Kryo deserialization of persisted context without class allowlist...

Use of Less Trusted Source

Overview org.springframework.cloud:spring-cloud-gateway is a Affected versions of this package are vulnerable to Use of Less Trusted Source. Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded request headers it receives from untrusted proxies to downstream services. Both the...

CVE-2026-41700: Origin Validation Error

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials...

VMware Spring for GraphQL Access Control Vulnerability

VMware Spring for GraphQL is a GraphQL application development framework provided by the American company VMware. Versions of VMware Spring for GraphQL such as 2.0.0 and earlier, 1.4.0 and earlier, 1.3.0 and earlier, as well as 1.0.0 and earlier, have a access control vulnerability. This...

VMware Spring Web Services code-related vulnerabilities

VMware Spring Web Services is a SOAP Web services development framework provided by the American company VMware. There are code vulnerabilities in versions 5.0.0 to 5.0.1, 4.1.0 to 4.1.3, 4.0.0 to 4.0.18, and 3.1.0 to 3.1.8 of VMware Spring Web Services. These vulnerabilities stem from the use of...

VMware Spring Web Services encryption vulnerability

VMware Spring Web Services is a SOAP web service development framework provided by the American company VMware. There are vulnerabilities related to encryption in VMware Spring Web Services versions 5.0.0 to 5.0.1, 4.1.0 to 4.1.3, 4.0.0 to 4.0.18, and 3.1.0 to 3.1.8. These vulnerabilities stem fr...