9895 matches found
Deserialization Of Untrusted Data
Spring Batch is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to DefaultExecutionContextSerializer passing Base64-decoded data directly to ObjectInputStream.readObject without an ObjectInputFilter, which allows an attacker to provide malicious serialized objects and...
CLSA-2026-1788865685 TuxCare security update for org.springframework (9 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 9 CVEs. Fixed in 4.3.25.RELEASE-tuxcare.5...
Sensitive Data Exposure
org.springframework.cloud, spring-cloud-function-adapter-aws is vulnerable to sensitive data exposure. The vulnerability is due to sensitive information being included in application logs, which allows an attacker with access to the logs to obtain potentially confidential data...
Denial Of Service (DoS)
Spring Framework is vulnerable to Denial Of Service. The vulnerability is due to stream corruption when Server-Sent Events SSE are used with functional web framework applications in Spring MVC...
Base Function Poisoning
Spring Cloud Function is vulnerable to base function poisoning. The vulnerability is due to improper handling of function composition lookup, which allows an attacker to manipulate or poison the base function and potentially execute unintended function compositions...
Cache Leakage
Spring AI is vulnerable to cache leakage. The vulnerability is due to the context hash used in the Semantic Cache support to isolate cached responses between different system prompts, where the hash may not provide sufficient separation and attackers can cause cached responses from one context to...
Timing Attack
Spring Security is vulnerable to a timing attack. The vulnerability is due to the use of String.equals, which returns early when a character differs, causing response times to vary based on the number of matching leading characters and allowing an attacker to perform timing analysis to...
Insecure Deserialization
Spring Cloud Stream is vulnerable to insecure deserialization. The vulnerability is due to deserialization of untrusted types, where crafted serialized objects are deserialized without validation and attackers can supply malicious payloads to achieve code execution...
Man-In-The-Middle (MitM)
org.springframework.amqp, spring-rabbit is vulnerable to a man-in-the-middle MitM. The vulnerability is due to the Log4j2 appender relying on an insecure documented default TLS configuration, which allows an attacker capable of intercepting the TLS connection to perform a man-in-the-middle attack...
UnboundID LDAP Server Administrative Credential Exposure
Spring Security is vulnerable to an UnboundID LDAP Server Administrative Credential Exposure. The vulnerability is due to the embedded UnboundID LDAP server UnboundIdContainer unconditionally registering an administrative credential and binding its listener to all available network interfaces,...
This Week in Spring - September 8th, 2026
Bonjour a tout le monde! Welcome to another rip-roarin' installment of This Week in Spring! It's a fabulous and fun day here in Paris, France, as I wait to board the train to Amsterdam for the IntelliJ IDEA conference! It's going to be amazing. We've got another incredible week's roundup to dive...
PT-2026-87760
Name of the Vulnerable Software and Affected Versions Spring Cloud Azure affected versions not specified Description Improper authentication allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that...
CVE-2026-69854: Improper Authentication
Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...
CLSA-2026-1788820092 TuxCare security update for org.springframework.integration (5 CVEs)
TuxCare rebuilt 39 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.20-tuxcare.6...
CLSA-2026-1788813738 TuxCare security update for org.springframework (8 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 8 CVEs. Fixed in 5.0.13.RELEASE-tuxcare.5...
CLSA-2026-1788807216 TuxCare security update for org.springframework (11 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 11 CVEs. Fixed in 5.1.20.RELEASE-tuxcare.5...
CLSA-2026-1788806164 TuxCare security update for org.springframework.graphql (3 CVEs)
TuxCare rebuilt 2 org.springframework.graphql packages to address 3 CVEs. Fixed in 1.4.6-tuxcare.1...
CLSA-2026-1788804848 TuxCare security update for org.springframework (14 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 14 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.6...