1038 matches found
Spring Framework server Web DoS Vulnerability
In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: Typically, Spring Boot applications need the...
Reactor Netty HTTP Server Metrics DoS Vulnerability
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in...
Security Bypass With Wildcard Pattern Matching on Cloud Foundry
In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are true: NOTE:...
Security Bypass With Un-Prefixed Double Wildcard Pattern
Using "" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass...
Spring Cloud Gateway HTTP2 Insecure TrustManager
Applications using Spring Cloud Gateway that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates...
Spring-AMQP Remote Denial of Service - Out of Memory Error with a Large Message Body
The Spring AMQP Message object, in its toString method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message body...
Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability
Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data , the path elements following...
RFD Protection Bypass via jsessionid
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter...
DoS Via Malformed URL with Reactor Netty HTTP Server
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response...
Reactor Netty authentication leak in redirects
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to...
XML External Entity Injection (XXE)
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...
Access Control Bypass in Spring Security
When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is...
Incomplete fix for CVE-2013-7315 / CVE-2013-6429 (XXE)
Spring MVC's Jaxb2RootElementHttpMessageConverter also processed user provided XML and neither disabled XML external entities nor provided an option to disable them. Jaxb2RootElementHttpMessageConverter has been modified to provide an option to control the processing of XML external entities and...
CVE-2026-59319
CVE-2026-59319...
CVE-2026-59314
CVE-2026-59314...
CVE-2026-59288
CVE-2026-59288...
CVE-2026-59287
CVE-2026-59287...
CVE-2026-59292
CVE-2026-59292...
cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader...
cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist
cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist...
cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation
cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation...
cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse...
cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch
cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch...
cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests
cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests...
cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder...
cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass
cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass...
cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification
cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification...
cve-2026-59271 - MEDIUM - Admin password disclosed in BrokerNotAliveException message
cve-2026-59271 - MEDIUM - Admin password disclosed in BrokerNotAliveException message...
cve-2026-40984 - HIGH - Micrometer HTTP server instrumentations DoS vulnerability
cve-2026-40984 - HIGH - Micrometer HTTP server instrumentations DoS vulnerability...
cve-2026-40983 - HIGH - Micrometer gRPC server instrumentation DoS vulnerability
cve-2026-40983 - HIGH - Micrometer gRPC server instrumentation DoS vulnerability...
cve-2026-41007 - HIGH - Spring HATEOAS heap exhaustion through unbounded internal caching
cve-2026-41007 - HIGH - Spring HATEOAS heap exhaustion through unbounded internal caching...
This Week in Spring - March 17th, 2026
Hi, Spring fans! Welcome to another rip-roaring installment of This Week in Spring , which I'm posting ahead of my keynote at the amazing JavaOne 2026 event here in sunny San Francisco, California! I love Piotr's latest post on using local AI models with LM Studio and Spring AI Did you see the ne...
Spring Session Hazelcast: Now Led by Hazelcast Team
It gives me great pleasure to announce that the Spring Session Hazelcast project will now be led by the Hazelcast Team. NOTE: This announcement is in alignment with our announcement Spring Session MongoDB: Now Led by MongoDB Team. For ten years Spring Session has provided the infrastructure for...
Spring Session MongoDB: Now Led by MongoDB Team
It gives me great pleasure to announce that the Spring Session MongoDB project will now be led by the MongoDB Team. NOTE: This announcement is in alignment with our announcement Spring Session Hazelcast: Now Led by Hazelcast Team. For ten years Spring Session has provided the infrastructure for...
This Week in Spring - September 23rd, 2025
Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm preparing my talks for several amazing shows including: Commit Your Code conference in Plano, Texas starting tomorrow; Dev2Next in Colorado; Devoxx Belgium in Antwerp, Belgium; and CloudFoundry Days in Germany. So much go...
A Bootiful Podcast: Andrey Belyaev, product manager for IntelliJ IDEA
Hi, Spring fans! In this installment, we talk to Andrey Belyaev, a Product Manager at JetBrains working on the IntelliJ IDEA product, about the latest-and-greatest support for Spring in Jetbrains IntelliJ IDEA!...
A Bootiful Podcast: José Paumard, Java developer advocate and professor
Hi, Spring fans! In this installment, recorded at Devoxx UK 2025, I talk to the legendary professor of computer science and legend José Paumard about Java, the ecosystem, and more,...
A Bootiful Podcast: Wiremock's leaders Lee Turner and Tom Akehurst
Hi, Spring fans! In this installment we talk to Wiremock's leaders Lee Turner and Tom Akehurst...
A Bootiful Podcast: Intact's Luke Shannon
Hi, Spring fans! and happy holidays! in this installment I talk to Intact's Luke Shannon about their use of Spring, developer portals, and so much more...
A Bootiful Podcast: Oracle Developer Advocate Andres Almiray
Hi, Spring fans! In this installment I talk to Oracle developer advocate Andres Almiray about the latest-and-greatest in the amazing Oracle database. Oracle SQL Java JConf...
A Bootiful Podcast: Sébastien Deleuze on Spring Framework and Kotlin, GraalVM, Project Leyden, AppCDS, runtime efficiency, Kotlin, and more
Dive deep into the world of Spring Framework and Kotlin, GraalVM, Project Leyden, AppCDS, runtime efficiency, Kotlin, and more, with the one and only Sébastien Deleuze! From runtime efficiency to all things Kotlin, this episode is packed with expert insights and valuable information. Don't miss o...
Spring Modulith 0.3 released
Hot on the heels of Spring Boot 3.0.2, I am excited to announce the 0.3 release of Spring Modulith. The release is packed with improvements. We have tweaked a couple of things that might require your attention and a couple of adapting changes to your code. The most notable changes are: GH-114 – W...
Spring Expression DoS Vulnerability
In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0 - 5.2.19, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition...
Potential Security Bypass for customized Spring Data REST Resource
In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...
Jackson Configuration Allows Code Execution with Unknown “Serialization Gadgets”
When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means...
CVE-2026-59306
CVE-2026-59306...
CVE-2026-59323
CVE-2026-59323...
CVE-2026-59318
CVE-2026-59318...