CLSA-2026-1788527138 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 2 CVEs. Fixed in 6.0.23-tuxcare.9...

CLSA-2026-1788526262 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.0.13-tuxcare.4...

CLSA-2026-1788525613 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.0.16-tuxcare.8...

CLSA-2026-1788525419 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 2 CVEs. Fixed in 6.0.0-tuxcare.3...

spring-ai-sibling-loop-poc

Spring AI PDF Reader — sibling self-loop PoC incomplete fix of CVE-2026-47851 Minimal reproduction for an infinite loop / OOM in org.springframework.ai.reader.pdf.config.ParagraphManager of org.springframework.ai:spring-ai-pdf-document-reader. Reported as a private GitHub Security Advisory to...

Denial-of-Service (DoS)

org.springframework.amqp, spring-amqp is vulnerable to a Denial-of-Service DoS. The vulnerability is due to improper handling of compressed messages during message decompression, which allows an attacker who can publish a specially crafted 1 MB message to a queue consumed by an application with...

Uncontrolled Memory Allocation

Spring Integration is vulnerable to uncontrolled memory allocation. The vulnerability is due to the deserializer trusting the sender-supplied octet count and allocating a byte array of the specified size without an upper limit, which allows an attacker to send a maliciously large frame length and...

Optimistic Locking/version Validation Bypass

Spring Data REST is vulnerable to improper handling of the persisted @Version property during HTTP PUT requests against immutable target types. The vulnerability is due to Spring Data REST failing to preserve the persisted version value of an aggregate root when processing a PUT request, which...

CLSA-2026-1788508154 TuxCare security update for org.springframework.pulsar (1 CVE)

TuxCare rebuilt 6 org.springframework.pulsar packages to address 1 CVE. Fixed in 1.2.13-tuxcare.4...

CLSA-2026-1788508031 TuxCare security update for org.springframework.ws (2 CVEs)

TuxCare rebuilt 6 org.springframework.ws packages to address 2 CVEs. Fixed in 4.0.17-tuxcare.5...

Denial Of Service

Spring for GraphQL is vulnerable to Denial of Service. The vulnerability is due to improper handling of the WebSocket client keepAlive feature, where the client maintains persistent connections without adequate limits and an attacker can trigger excessive resource consumption to cause a denial of...

Integrity Check Bypass

Spring for GraphQL is vulnerable to an integrity check bypass. The vulnerability is due to loading JavaScript libraries from a public CDN without Subresource Integrity checks, where an attacker can inject malicious code into those scripts and execute arbitrary code on the browser loading the...

Unsafe Deserialization

Spring for GraphQL is vulnerable to Unsafe Deserialization. The vulnerability is due to unsafe deserialization of paginated GraphQL query data, where crafted serialized objects can be supplied and deserialized without proper validation, allowing attackers to execute arbitrary code...

IP Address Disclosure

Spring Security is vulnerable to IP address disclosure. The vulnerability is due to improper IP classification logic in the InetAddressMatchers utility, where the matchInternal and matchExternal builders can be manipulated to incorrectly classify private IP addresses as public, allowing an attack...

Improper Authorization

Spring Framework is vulnerable to Improper Authorization. The vulnerability is due to a header predicate bypass in pre-flight requests for WebFlux functional endpoints deployed with DispatcherServlet, allowing an attacker to bypass intended header-based restrictions...

Improper Security Configuration

Spring Framework is vulnerable to Improper Security Configuration. The vulnerability is due to response cookies being serialized without the SameSite attribute in WebFlux applications using the Jetty 12 Core reactive adapter...

Memory Leak

Spring Framework is vulnerable to a memory leak. The vulnerability is due to a malformed SETUP frame, where the RSocket server allocates resources without proper cleanup and an attacker can repeatedly send crafted frames to exhaust memory...

Missing Authentication

Spring Cloud Config is vulnerable to a Missing Authentication for Critical Function. The vulnerability is due to unvalidated Webhook requests to the Spring Cloud Config Server’s /monitor endpoint, which allows an attacker to send unauthorized requests and potentially trigger protected functionali...

Time-of-Check Time-of-Use (TOCTOU)

Spring Cloud Config is vulnerable to a Time-of-Check Time-of-Use TOCTOU vulnerability. The vulnerability is due to insufficient synchronization between checking and using the SVN repository base directory, which allows an attacker to exploit the time gap to manipulate the directory and potentiall...

Resource Exhaustion

Spring WebFlux is vulnerable to Resource Exhaustion. The vulnerability is due to the PartEventHttpMessageReader not enforcing the maxPartSize limit when maxInMemorySize is set to -1, where an attacker can send arbitrarily large multipart requests that consume excessive memory and trigger a...