Lucene search
+L
SpringMost viewed

935 matches found

Spring Security Advisories
Spring Security Advisories
added 2024/07/24 12:0 a.m.11 views

This Week in Spring - July 23rd, 2024

Hi, Spring fans! It's such an exciting time to be alive! I hope you're doing well. It's nearly the end of July, already! Time is flying and as always the community has not disappointed with their incredible content. Let's dive right into it! have you registered for SpringOne 2024 yet? I love this...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/07/09 12:0 a.m.11 views

This Week in Spring - July 9th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! And what a week it's been! We've got a lot to get into, so let's dive right in. I quite liked this talk, Continuations: The magic behind virtual threads in Java by Balkrishna Rawool @ Spring I/O 2024 In last week's episode of...

7.3AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/06/19 12:0 a.m.11 views

Spring Cloud Function Web DOS Vulnerability

Description In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions. Specifically, an application is vulnerable when all of the following are true: User is...

8.2CVSS7.1AI score0.0127EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/06/18 12:0 a.m.11 views

Spring Tips: Introducing Spring Modulith

Hi, Spring fans! In this installment we look at the amazing Spring Modulith project. It's goal is to help you better structure your codebase for architectural scalability. It's an amazing and refreshing approach to building applications. Think of it like a chance to pair program on the architectu...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/03/21 12:0 a.m.11 views

A Bootiful Podcast: Stuart Marks (aka ”Dr. Deprecator”) on Java, its amazing features, and more

Hi, Spring fans! Happy one-day-belated Java 22 release day to those who celebrate! To ring in the new release, we've got an extra special and incredible discussion with a Java legend - somebody who's been involved in the Java community and work for decades - Stuart Marks, or "Dr. Deprecator," as...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/02/29 12:0 a.m.11 views

A Bootiful Podcast: Roni Dover on Digma AI

Hi, Spring fans! In this installment we talk to Digma AI founder Roni Dover...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2023/12/12 12:0 a.m.11 views

This Week in Spring - December 12th, 2023

Hi, Spring fans! Welcome to a new installment of This Week in Spring! We've got a ton of stuff to get into, so let's dive right in! Laur Spilca and I look at how to ugprade a Spring Security 5.x application to Spring Security 6.x. Apache SkyWalking with Sheng Wu and Apache ShardingSphere with...

7.1AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2023/10/12 12:0 a.m.11 views

A Bootiful Podcast: Java Language Architect Brian Goetz

Hi, Spring fans! Are you using Java 21 in production already? No? you should listen to this episode. Yes? Then you should listen to this episode! This week, Josh Long talks to legendary Java Language Architect Brian Goetz @BrianGoetz recaping the latest-and-greatest and previewing Java.next...

6.9AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2023/04/20 12:0 a.m.11 views

A Bootiful Podcast: Gradle Developer Advocate, Java Champion, and legend Trisha Gee

Hi, Spring fans! In this installment, Java Champion and legend Trisha Gee @trishagee rejoins the show to talk about Gradle, developer productivity, and so much more...

6.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2023/03/02 12:0 a.m.11 views

A Bootiful Podcast: Spring Cloud Stream and Spring Cloud Function lead Oleg Zhurakousky

Hi Spring fans! Welcome to another installment of a bootiful podcast! in this installment, our pal Oleg Zhurakousky @zoleg, lead of Spring Cloud Stream and Spring Cloud Function, rejoins the show to talk about the latest and greatest in stream processing...

1.3AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2023/02/09 12:0 a.m.11 views

A Bootiful Podcast: opensource, Spring Cloud, and Kubernetes maestro Abel Salgado Romero

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Abel Salgado Romero @abelsromero about open source, Kubernetes, and building Kubernetes controllers with Spring Boot and GraalVM native images...

2.6AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2023/01/26 12:0 a.m.11 views

A Bootiful Podcast: GraalVM advocate Alina Yurenko on a Bootiful Podcast

Liiiive from New York, it's a Bootiful Podcast! This week I @starbuxman talk to Developer Advocate for GraalVM at Oracle Labs, and legend, Alina Yurenko @alinayurenko...

2.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2015/03/06 12:0 a.m.11 views

Insufficiently random session id in Java SockJS client

Session id generation in the Java SockJS client is not sufficiently secure and could allow a user to send messages to another user’s session. Note that this only affects users of the Java SockJS client, which generates its own session id. It does not affect browser clients even if they’re...

5CVSS5.4AI score0.019EPSS
Exploits0References2
Spring Security Advisories
Spring Security Advisories
added 2026/07/02 12:0 a.m.10 views

A Bootiful Podcast: Sébastien Deleuze on the latest-and-greatest in Spring AI and Spring Framework

Hi Spring fans! In this installment we talk to the legendary Spring AI and Spring Framework contributor Sébastien Deleuze about the latest-and-greatest in AI, Kotlin, the framework, and more...

5.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/06/11 12:0 a.m.10 views

cve-2026-47825 - HIGH - Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations

cve-2026-47825 - HIGH - Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations...

8.6CVSS6.1AI score0.00139EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/06/11 12:0 a.m.10 views

cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability...

7.5CVSS6.1AI score0.00278EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/06/09 12:0 a.m.10 views

This Week in Spring - June 9th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! Tons of releases coming out today and this week! So make sure you're pulling in the latest posts, as often as possible! Spring LDAP 2026.06 Releases - Contains CVE Fix Spring Framework 7.0.8 and 6.2.19 Available Now Spring...

5.6AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/06/09 12:0 a.m.10 views

cve-2026-40988 - HIGH - Unbounded DEFLATE Inflation in SAML 2.0 Service Provider

cve-2026-40988 - HIGH - Unbounded DEFLATE Inflation in SAML 2.0 Service Provider...

7.5CVSS6.1AI score0.00331EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/06/09 12:0 a.m.10 views

cve-2026-41695 - HIGH - Denial of Service in Spring Data Commons Property Path Resolution

cve-2026-41695 - HIGH - Denial of Service in Spring Data Commons Property Path Resolution...

7.5CVSS6.1AI score0.00363EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/06/09 12:0 a.m.10 views

cve-2026-41837 - MEDIUM - Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys

cve-2026-41837 - MEDIUM - Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys...

5.3CVSS6.1AI score0.00191EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/06/08 12:0 a.m.10 views

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP...

7.4CVSS5.2AI score0.00257EPSS
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/06/08 12:0 a.m.10 views

Spring Framework Denial of Service via AntPathMatcher

Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher :...

3.7CVSS5.7AI score0.00317EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/05/28 12:0 a.m.10 views

A Bootiful Podcast: Microsoft's Martijn Verburg

Hi Spring fans! In this installment, I talk to my friend from JClarity and Microsoft fame, fellow Java champion, and Java guru Martijn Verburg ai microsoft java jclarity performance...

5.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/05/21 12:0 a.m.10 views

A Bootiful Podcast: Hadi Hariri, Jetbrains legend

Hi Spring and Kotlin fans! In this installment, I have the privilege of talking to my old friend and JetBrains legend Hadi Hariri, recorded live from Kotlin Conf 2026 in Munich, Germany! kotlin jvm java springboot...

5.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/05/08 12:0 a.m.10 views

Unbounded cache for function definitions

OOM error is possible while attempting to add infinite amount of functions to Function Registry...

5.7CVSS5.8AI score0.00211EPSS
Exploits0References1
Spring Security Advisories
Spring Security Advisories
added 2026/05/06 12:0 a.m.10 views

Spring Cloud Config Server Logged Sensitive Information

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs...

4.4CVSS5.8AI score0.00168EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/04/27 12:0 a.m.10 views

VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId . Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input ...

5.9CVSS5.8AI score0.00233EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/04/23 12:0 a.m.10 views

A Bootiful Podcast: A Bootiful Podcast: Dr. Venkat Subramaniam and James Ward on Intelligent Kotlin and So Much More

I am beyond thrilled that I got to co-present with two legends, Dr. Venkat Subramaniam and James Ward, at Voxxed Days Amsterdam, and even more so that they both sat down for a quick discussion with me right before that presentation. Enjoy!...

5.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/04/17 12:0 a.m.10 views

Spring Framework DoS with Multipart Temp Files in WebFlux

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space...

6.5CVSS5.8AI score0.00344EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2026/03/26 12:0 a.m.10 views

A Bootiful Podcast: Daniel Garnier-Moiroux on MCP Security

Hi Spring, AI, Spring AI, security, and Spring Security fans! In this installment I talk to the legendary Daniel-Garnier Moiroux! ai mcp security java...

5.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/03/10 12:0 a.m.10 views

This Week in Spring - March 10th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring. As I write this, I am preparing for a trip to Rust, Germany, for one of the best Java conferences in Europe: JavaLand, along with its new companion event, DevLand. It should be fun. Will you be around? If so, say hi. We have ...

5.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/03/09 12:0 a.m.10 views

This Week in Spring - March 9th, 2026

Hi Spring fans! Welcome to another rip-roaring installment of This Week in Spring! I'm writing this in an Uber en route to the airport to get to awsome Atlanta, GA, for Devnexus 2026! Who's goin'? You goin'? We - the Spring team - will be there in force! Come say hi at the boothes or come see our...

5.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/01/27 12:0 a.m.10 views

This Week in Spring - January 27th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this, I cannot believe we're nearly at the end of the month! Time sure flies. Spring AI 2.0.0-M2 is available now Spring Modulith 2.1 M1, 2.0.2, and 1.4.7 released In last week's installment of A Bootiful Podcast ,...

5.9AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2026/01/06 12:0 a.m.10 views

This Week in Spring - January 6th, 2026

Hi, Spring fans, to the first installment of This Week in Spring in the new year and , roughly, the fifteenth anniversary edition of this series! I've been writing these blogs since the first week of January of 2011, and I am proud to say that I haven't so far missed a single week! I've always...

6.9AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2025/09/16 12:0 a.m.10 views

Connect Your AI to Everything: Spring AI's MCP Boot Starters

The Model Context Protocol MCP standardizes how AI applications interact with external tools and resources. Spring joined the MCP ecosystem early as a key contributor, helping to develop and maintain the official MCP Java SDK that serves as the foundation for Java-based MCP implementations...

7.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2025/09/09 12:0 a.m.10 views

This Week in Spring - September 9th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I am home, ensconced in my studio here in somewhat sunny San Francisco, California, relaxing and trying to catch up on stuff I missed. As always, there's a ton! So let's dive right into it. Some of the amazing features that...

6.8AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2025/09/04 12:0 a.m.10 views

A Bootiful Podcast: Spring Cloud guru Ryan Baxter

Hi, Spring fans! In this installment we talk to the amazing Spring Cloud contributor Ryan Baxter, live from SpringOne 2025!...

7AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2025/09/02 12:0 a.m.10 views

The Road to GA - Introduction

As you all should be aware by now, the Spring portfolio is in the process of driving towards the next major versions to be released in November of this year. This will be only the fourth major generation for Spring Boot and the seventh major generation for Spring Framework in its over 20 year...

6.9AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2025/07/15 12:0 a.m.10 views

Authentication Leak On Redirect With Reactor Netty HTTP Client

In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects...

6.1CVSS6.4AI score0.0034EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2025/06/26 12:0 a.m.10 views

A Bootiful Podcast: DevOps and AI luminary Patrick Debois

Hi, Spring, cloud native, and AI fans! In this installment, I had the opportunity to briefly sit down and talk with DevOps and AI luminary Patrick Debois, from the amazing Devoxx UK 2025 show...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2025/06/19 12:0 a.m.10 views

A Bootiful Podcast: Micrometer.io lead Tommy Ludwig on the latest-and-greatest in observability for the Spring developer

Hi, Spring fans! In this episode, I talk to Micrometer.io lead Tommy Ludwig on the latest-and-greatest in observability for the Spring developer...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2025/06/12 12:0 a.m.10 views

RFD Attack via “Content-Disposition” Header Sourced from Request

In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an...

6.5CVSS7.1AI score0.00513EPSS
Exploits0References2Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2025/06/05 12:0 a.m.10 views

A Bootiful Podcast: IntelliJ IDEA lead Aleksey Stukalov

Hi, Spring fans! In this installment I talk to IntelliJ IDEA lead Aleksey Stukalov...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2025/05/27 12:0 a.m.10 views

Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies...

8.6CVSS7.3AI score0.0029EPSS
Exploits0References1Affected Software2
Spring Security Advisories
Spring Security Advisories
added 2025/05/19 12:0 a.m.10 views

Spring Security authorization bypass for method security annotations on private methods

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: In that case, the target method may be able to be invoked without proper authorization. You...

9.1CVSS7AI score0.00535EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2025/04/22 12:0 a.m.10 views

Spring Security BCryptPasswordEncoder maximum password length breaks timing attack mitigation

The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider...

5.3CVSS6AI score0.00402EPSS
Exploits0References1Affected Software1
Spring Security Advisories
Spring Security Advisories
added 2025/02/13 12:0 a.m.10 views

A Bootiful Podcast: Spring Legend Glenn Renfro on Devnexus 2025, Cold brews, and More

Hi, Spring fans! In today's installment, I talk to Spring legend Glenn Renfro...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2025/02/04 12:0 a.m.10 views

This Week in Spring - February 4th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's February 4th, 2025, as I write this. We are ten days away from Valentine's day, and about a month away from Devnexus. Lots to look forward to, in both the short term and the long term! Let's dive right into this week's...

7.3AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2025/01/07 12:0 a.m.10 views

This Week in Spring - January 7th, 2025

Hi, Spring fans, and happy new year! It's been another super seven days since we last spoke and, as always, there's a lot to cover so let's dive right into it! A long time in coming, but it's finally here! Hello DCO, Goodbye CLA: Simplifying Contributions to Spring the Spring AI hits just keep on...

7.2AI score
Exploits0
Spring Security Advisories
Spring Security Advisories
added 2024/12/03 12:0 a.m.10 views

Extending Spring Data Repositories Just Got Easier

Since its inception, Spring Data Repositories have been designed for extension, whether you want to customize a single query method or provide a completely new base implementation. The 2024.1 release enhances your ability to extend a repository with custom functionality making it easier than ever...

6.9AI score
Exploits0
Total number of security vulnerabilities935