9327 matches found
CLSA-2026-1788410329 TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.5-tuxcare.1...
CVE-2026-80515: Use of Non-Canonical URL Paths for Authorization Decisions
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL.toString.contains"/mgmt/". Tomcat returns getRequestURL un-decoded, while Spring MVC's...
A Bootiful Podcast: BellSoft's Catherine Edelveis on hardened runtime images, container security, and more
Hi, Spring fans! I chat with BellSoft’s Catherine Edelweiss about using buildpacks and hardened images to ship Spring Boot apps with stronger security, cleaner defaults, and far less Dockerfile pain. BellSoft Docker Java JRE SpringBoot...
Linux Distros Unpatched Vulnerability : CVE-2026-59272
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of...
PT-2026-85026
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL.toString.contains"/mgmt/". Tomcat returns getRequestURL un-decoded, while Spring MVC's...
CLSA-2026-1788376116 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 6 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.4...
CLSA-2026-1788372470 TuxCare security update for org.springframework (21 CVEs)
TuxCare rebuilt 23 org.springframework packages to address 21 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.4...
CVE-2026-47891
A flaw was found in Spring WebFlux applications that utilize the Aalto XML processor to parse XML input. A remote attacker could exploit this vulnerability by sending specially crafted XML, causing the application to bypass the maxInMemorySize limit. This can lead to excessive memory consumption,...
CLSA-2026-1788363279 TuxCare security update for org.springframework (9 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 9 CVEs. Fixed in 5.3.37-tuxcare.10...
CLSA-2026-1788362569 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 26 org.springframework packages to address 1 CVE. Fixed in 6.1.4-tuxcare.3...
CLSA-2026-1788361436 TuxCare security update for org.springframework (13 CVEs)
TuxCare rebuilt 23 org.springframework packages to address 13 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.10...
CLSA-2026-1788360559 TuxCare security update for org.springframework (29 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 29 CVEs. Fixed in 5.3.21-tuxcare.1...
CLSA-2026-1788359035 TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 5 org.springframework.data packages to address 1 CVE. Fixed in 3.7.18-tuxcare.7...
Path Traversal
Spring AI is vulnerable to Path Traversal. The vulnerability is due to ResourceCacheService.getCacheName appending an unvalidated URI fragment to the cache filename, allowing path separators or .. sequences to escape the intended resourceParentFolder when writing downloaded files...
CVE-2026-59276
Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...
CVE-2026-59277
Spring Security InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. In Spring Security 7.1.0, the internal address classification did...
CLSA-2026-1788349534 TuxCare security update for org.springframework (7 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 5.3.27-tuxcare.9...
CLSA-2026-1788349330 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.29-tuxcare.9...