1038 matches found
cve-2026-47856 - MEDIUM - JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list
cve-2026-47856 - MEDIUM - JsonToObjectTransformer resolves the jsonTypeId message header to an arbitrary class without an allow-list...
cve-2026-47857 - MEDIUM - Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
cve-2026-47857 - MEDIUM - Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around...
cve-2026-47883 - MEDIUM - Spring Framework Open Redirect in UrlHandlerFilter
cve-2026-47883 - MEDIUM - Spring Framework Open Redirect in UrlHandlerFilter...
cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse...
cve-2026-59278 - MEDIUM - In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages
cve-2026-59278 - MEDIUM - In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages...
cve-2026-59279 - HIGH - Unbounded persistent session allocation via repeated initialize requests
cve-2026-59279 - HIGH - Unbounded persistent session allocation via repeated initialize requests...
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler...
cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader
cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader...
cve-2026-47892 - MEDIUM - Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
cve-2026-47892 - MEDIUM - Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints...
cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint
cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint...
cve-2026-59293 - MEDIUM - SMB minimum protocol dialect defaults to SMB1
cve-2026-59293 - MEDIUM - SMB minimum protocol dialect defaults to SMB1...
cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names
cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names...
cve-2026-59272 - MEDIUM - Log4j2 AmqpAppender disables TLS hostname verification by default
cve-2026-59272 - MEDIUM - Log4j2 AmqpAppender disables TLS hostname verification by default...
cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization
cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization...
cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch
cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch...
cve-2026-47860 - MEDIUM - Unbounded decompression of attacker-supplied compressed message bodies
cve-2026-47860 - MEDIUM - Unbounded decompression of attacker-supplied compressed message bodies...
cve-2026-47852 - HIGH - Predictable cache directory location allows local ONNX model substitution in Spring AI
cve-2026-47852 - HIGH - Predictable cache directory location allows local ONNX model substitution in Spring AI...
cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests
cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests...
cve-2026-47862 - MEDIUM - ZipTransformer uses file_name header to build workDirectory path without sanitization
cve-2026-47862 - MEDIUM - ZipTransformer uses filename header to build workDirectory path without sanitization...
cve-2026-59274 - MEDIUM - Unbounded decompression in UnZipTransformer enables zip-bomb DoS
cve-2026-59274 - MEDIUM - Unbounded decompression in UnZipTransformer enables zip-bomb DoS...
cve-2026-47859 - MEDIUM - Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
cve-2026-47859 - MEDIUM - Unbounded memory allocation in RFC6587SyslogDeserializer octet-counted framing — remote DoS...
cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush
cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush...
cve-2026-47877 - HIGH - Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
cve-2026-47877 - HIGH - Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting XSS...
cve-2026-59275 - MEDIUM - Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)
cve-2026-59275 - MEDIUM - Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit99...
cve-2026-59276 - MEDIUM - Timing Attack via Non-Constant-Time Comparison of Sensitive Values
cve-2026-59276 - MEDIUM - Timing Attack via Non-Constant-Time Comparison of Sensitive Values...
cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader...
cve-2026-59282 - MEDIUM - Spring Framework Denial of Service via Unbounded List Growth in Data Binding
cve-2026-59282 - MEDIUM - Spring Framework Denial of Service via Unbounded List Growth in Data Binding...
cve-2026-47884 - MEDIUM - Spring Framework Improper Path Limitation in XsltView
cve-2026-47884 - MEDIUM - Spring Framework Improper Path Limitation in XsltView...
cve-2026-59311 - MEDIUM - Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
cve-2026-59311 - MEDIUM - Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation...
cve-2026-47844 - MEDIUM - Reactor Netty HTTP Server Leaks Exception Details
cve-2026-47844 - MEDIUM - Reactor Netty HTTP Server Leaks Exception Details...
cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass
cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass...
cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN...
cve-2026-47845 - MEDIUM - Reactor Netty HTTP Server may incorrectly evaluate proxy addresses
cve-2026-47845 - MEDIUM - Reactor Netty HTTP Server may incorrectly evaluate proxy addresses...
cve-2026-47848 - MEDIUM - Reactor Netty WebSocket Client Leaks Credentials On Redirect
cve-2026-47848 - MEDIUM - Reactor Netty WebSocket Client Leaks Credentials On Redirect...
cve-2026-47864 - MEDIUM - Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
cve-2026-47864 - MEDIUM - Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution...
cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC
cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC...
cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist...
cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure
cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure...
cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces...
cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification
cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification...
cve-2026-59271 - MEDIUM - Admin password disclosed in BrokerNotAliveException message
cve-2026-59271 - MEDIUM - Admin password disclosed in BrokerNotAliveException message...
cve-2026-47886 - MEDIUM - Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions
cve-2026-47886 - MEDIUM - Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions...
cve-2026-59281 - MEDIUM - Spring Framework Cross-site Scripting via EscapedErrors
cve-2026-59281 - MEDIUM - Spring Framework Cross-site Scripting via EscapedErrors...
cve-2026-47893 - LOW - Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
cve-2026-47893 - LOW - Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService...
cve-2026-47887 - MEDIUM - Spring Framework Open Redirect in UrlFileNameViewController
cve-2026-47887 - MEDIUM - Spring Framework Open Redirect in UrlFileNameViewController...
cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder...
cve-2026-59283 - MEDIUM - Spring Framework Safety Guard Bypass via SpEL Expression Compilation
cve-2026-59283 - MEDIUM - Spring Framework Safety Guard Bypass via SpEL Expression Compilation...
This Week in Spring - August 18th, 2026
Hi, Spring fans! Welcome back to another edition of This Week in Spring. In my latest video, I dive into how to bake multitenancy into a system using Spring Security, OAuth, and a fantastic third-party project called Arconia. On that note, Arconia also shipped a fresh release that folds in severa...
Spring Office Hours Podcast: S5E20 - The Developer's Guide to AI with Danny Thompson
Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun are joined by Danny Thompson, Senior Developer Advocate at Atlassian, co-host of The Programming Podcast, and founder of The Commit Your Code Conference. Danny is also a co-author o...
A Bootiful Podcast: Redouble AI CTO and founder Andrey Santrosyan
Hi, Spring fans! In this installment, my friend James Ward and I sat down with Redouble AI CTO and founder Andrey Santrosyan This was an extra special episode because I conducted the interview with my friend, AWS' James Ward. https://www.linkedin.com/in/santrosyan/ https://redouble.ai...