Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure. id: CVE-2025-41243 info: name:...

Spring-CVE

Spring CVE これには、Spring SpEL / Expression Resource Access Vulnerability である CVE-2022-22963 と、spring-webmvc/spring-webflux の RCE であり「SpringShell」と称される CVE-2022-22965 が含まれます。 CVE-2022-22963 Spring Cloud Function バージョン 3.1.6、3.2.2、およびサポートされていない旧バージョンでは、ルーティング機能を使用する際に、ユーザーが特別に細工された SpEL を...

ROOT-APP-MAVEN-CVE-2024-38816 CVE-2024-38816 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38816 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38819 CVE-2024-38819 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38819 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-41243 CVE-2025-41243 in org.springframework.cloud:spring-cloud-gateway-server-webflux - Patched by Root

Root has patched CVE-2025-41243 in the org.springframework.cloud:spring-cloud-gateway-server-webflux package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-22740 CVE-2026-22740 in org.springframework:spring-webflux - Patched by Root

Root has patched CVE-2026-22740 in the org.springframework:spring-webflux package for Root:Maven. Multiple fixed versions available...

Security Bulletin: Vulnerabilities in Netty.Spring WebFlux,Spring Framework,Bootstrap,Angular,Lodash,spring-security-config,Underscore might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty.Spring WebFlux,Spring Framework,Bootstrap,Angular,Lodash,spring-security-config. Vulnerabilities include an escalation attack exchanging a known session ID for that of an authenticated user, Denial of...

Security Bulletin: Vulnerabilities in Netty,jackson-databind,Angular,bootstrap,React Router,decode-uri-component,Reactor Netty,Spring WebFlux,Spring Framework,spring-web might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, jackson-databind, Angular, bootstrap, React Router, decode-uri-component, Reactor Netty, Spring WebFlux, Spring Framework,spring-web. Vulnerabilities include allowing the renamed JSON key to be assigned...

Security Bulletin: Vulnerabilities in netty-codec, spring-webflux, spring-data, Spring MVC, Immutable and ACE might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in netty-codec, spring-webflux, spring-data, Spring MVC, Immutable and ACE. Vulnerabilities include Netty can cause native memory exhaustion, An attacker can bypass the short-circuit mechanism by sending a reques...

cve-2024-38821

cve-2024-38821 分析：https://www.deep-kondah.com/spring-webflux-static-resource-access-vulnerability-cve-2024-38821-explained/...

PoC-CVE-2022-22965-Spring4Shell

PoC — CVE-2022-22965 Spring4Shell 免責事項: このリポジトリは 教育および研究目的のみ を意図しています。 すべてのエクスプロイトスクリプトは、自分が所有するシステム、または明示的な書面による 許可を得たシステムに対してのみ使用する必要があります。著者は、この資料の誤用または損害について一切責任を負いません。 CVE-2022-22965は、2022年4月に公開されたSpring Frameworkにおける重大なリモートコード実行（RCE）脆弱性であり、その調査と概念実証（PoC）です。 脆弱性の概要 Spring4Shell...

CLEANSTART-2026-QW68592 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit

Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...

CLEANSTART-2026-LT41646 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request

Security vulnerability affects the apache-hive package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

cve-2024-38819-lab

CVE-2024-38819 カスタマーヴォールトラボ これは、CVE-2024-38819 向けの Cloud Foundry 対応 Spring Boot デモです。CVE-2024-38819 は、Spring Framework の機能的静的リソース処理におけるパストラバーサルの脆弱性です。 修正される内容 CVE-2024-38819 は Spring Framework で修正されており、Spring Boot 自体で直接修正されているわけではありません。 Spring Boot は、アプリケーションが使用する Spring Framework...

CVE-2026-47883

CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC このリポジトリは、Spring公式セキュリティアドバイザリとして公開された CVE-2026-47883 の最小再現PoCです。 公式アドバイザリ: https://spring.io/security/cve-2026-47883/ 公式タイトル: Spring Framework Open Redirect in UrlHandlerFilter 深刻度: Medium CVSS v3.1: 5.4...

cve-2024-38819

CVE-2024-38819 01. File-Traversal와 Webflux 개요 1 File-Traversal과 WebFlux 개요 File-Traversal경로 탐색, Path Traversal 취약점은 공격자가 웹 애플리케이션에서 파일 시스템의 권한을 우회하여 임의의 파일에 접근할 수 있도록 하는 취약점 이며 CWE-22로 지정 되어있는 공격의 일종 입니다. Spring WebFlux는 Spring 5에서 도입된 리액티브 프로그래밍을 지원하는 모듈로, 비동기 논블로킹 애플리케이션 개발을 지원하며 WebFlux.fn은 함수...

spring-RCE-CVE-2022-22965

취약점 개요 최근 Spring에서 대규모 CVE 취약점이 발견되었습니다. CVE 정보에 따르면 "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as...

CVE-2026-41841

A flaw was found in Spring MVC and WebFlux applications. A remote attacker could exploit this vulnerability by sending specially crafted requests when the application resolves static resources. This could lead to information disclosure, allowing the attacker to gain unauthorized access to sensiti...

CVE-2026-59281

A flaw was found in Spring MVC and WebFlux applications. When these applications are configured to obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors, they become vulnerable...