cve-2026-40988 - HIGH - Unbounded DEFLATE Inflation in SAML 2.0 Service Provider

cve-2026-40988 - HIGH - Unbounded DEFLATE Inflation in SAML 2.0 Service Provider...

cve-2026-41701 - MEDIUM - In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

cve-2026-41701 - MEDIUM - In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues...

cve-2026-41706 - MEDIUM - Open Redirect When Using CookieRequestCache

cve-2026-41706 - MEDIUM - Open Redirect When Using CookieRequestCache...

cve-2026-41731 - HIGH - In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

cve-2026-41731 - HIGH - In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization...

cve-2026-40983 - HIGH - Micrometer gRPC server instrumentation DoS vulnerability

cve-2026-40983 - HIGH - Micrometer gRPC server instrumentation DoS vulnerability...

cve-2026-40984 - HIGH - Micrometer HTTP server instrumentations DoS vulnerability

cve-2026-40984 - HIGH - Micrometer HTTP server instrumentations DoS vulnerability...

cve-2026-41710 - MEDIUM - Cache Exhaustion in Stateful Retries leads to Denial of Service

cve-2026-41710 - MEDIUM - Cache Exhaustion in Stateful Retries leads to Denial of Service...

CVE-2026-41842: Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, an attacker can send malicious requests that are slow to...

CVE-2026-41841: Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, an attacker can get access to a protected resource if a...

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP...

cve-2026-41007 - HIGH - Spring HATEOAS heap exhaustion through unbounded internal caching

cve-2026-41007 - HIGH - Spring HATEOAS heap exhaustion through unbounded internal caching...

cve-2026-41006 - HIGH - Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

cve-2026-41006 - HIGH - Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration...

CVE-2026-41840: Spring Framework Denial of Service via Multipart Requests in WebFlux

Spring WebFlux applications are vulnerable to Denial of Service DoS attacks when processing multipart requests. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, an attacker can send malicious multipart requests that can leak...

cve-2026-41715 - MEDIUM - Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect

cve-2026-41715 - MEDIUM - Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect...

CVE-2026-41838: Spring Framework Predictable Session ID in WebSocket Module

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules...

A Bootiful Podcast: JetBrains' Marit van Dijk

hi Spring and IntelliJ IDEA fans! In this installment I talk to my friend and JetBrains Developer Advocate extraordinaire Marit van Dijk! This episode was recorded at JNation, an amazing show in Coimbra, Portugal! jetbrains java jnation...

This Week in Spring - June 2nd, 2026

Hi, Spring fans, and welcome to another momentous installment of This Week in Spring! A lot to get into this week, but let's first take some time to address the meta: where are the May releases? If you read our May 11th post, you know they've been delayed. We wanted to speak a bit more about why ...

A Bootiful Podcast: Microsoft's Martijn Verburg

Hi Spring fans! In this installment, I talk to my friend from JClarity and Microsoft fame, fellow Java champion, and Java guru Martijn Verburg ai microsoft java jclarity performance...

This Week in Spring - May 26th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in Coimbra, Portugal, where I just did my usual shtick on the latest and greatest in Spring Framework 7.x, Spring Boot 4.x, and Spring AI 2.x. It was a ton of fun, and I want to thank everybody who came out. Last week I w...

A Bootiful Podcast: Hadi Hariri, Jetbrains legend

Hi Spring and Kotlin fans! In this installment, I have the privilege of talking to my old friend and JetBrains legend Hadi Hariri, recorded live from Kotlin Conf 2026 in Munich, Germany! kotlin jvm java springboot...

This Week in Spring - May 19th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring!, this one written from the back of a taxi racing to the local Frankfurt train station, where I'll take a train to Munich for the amazing Kotlin Conf 2026 edition, where I'll be part of the keynote and deliver a talk on the...

Spring Office Hours Podcast: S5E16 - May Release Train Shift & What's Coming in Spring Boot 4.1

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun break down the recently announced shift of the May release train from May 11-22 to June 1-5, and what that means for your upgrade planning across the Spring portfolio. They also dig...

A Bootiful Podcast: the legendary Adib Saikali

Hi, Spring fans! I'm so thrilled to have been able to sit down and talk to my friend Adib Saikali!...

This Week in Spring - May 12th, 2026

Hi, Spring fans! As I write this I am in Miami, FL at the CodeRemix.ai show, focused on the wide and wonderful world of OpenRewrite and Moderne. I've got a talk to give so let's dive right into it! a quick note about the upcoming release train dates in last week's installment of A Bootiful Podcas...

Spring Office Hours Podcast: S5E15 - Upgrading Spring and OSS Security

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun tackle two challenges every Spring developer faces: keeping applications up to date and staying ahead of security vulnerabilities in open source dependencies. They explore how AI...

ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users...

Self Routing guard bypassed via function composition

Under infinite recursion in the routing layer, request-handling can cause OOM error...

Unbounded cache for function definitions

OOM error is possible while attempting to add infinite amount of functions to Function Registry...

Expression injection in MilvusVectorStore doDelete allows data destruction

Spring AI's MilvusVectorStoredoDeleteList implementation is vulnerable to filter-expression injection via unsanitized document IDs...

A Bootiful Podcast: Daniel Garnier-Moiroux on his new book 'Testing Spring Boot Applications'

Hi Spring fans! In this installment I'm thrilled to have had the opportunity to sit down and talk to Daniel Garnier-Moiroux and talk about "Testing Spring Boot Applications," from Manning! testing springboot java kotlin springframework...

Directory Traversal with spring-cloud-config-server

Spring Cloud Config allows applications to server arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack...

Spring Cloud Config Server Logged Sensitive Information

When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs...

Spring Cloud Config Clients Can Access Secrets From Any Project The Config Server Has Access To On Google Secrets Manager

When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects...

This Week in Spring - May 5th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's May 5th, 2026, and I'm in Mainz, Germany, for the legendary JAX conference! It's been infinitely far too long since I've been at this amazing show, and I'm oh-so happy to be back here! Tonight, after my two talks here, I...

Spring Office Hours Podcast: S5E14 - Spec Driven Development with Simon Martinelli

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun are joined by Java Champion, Vaadin Champion, and Oracle ACE Pro Simon Martinelli to talk about Spec-Driven Development. With AI reshaping how we write code, Simon makes the case th...

Ronald Dehuysser, founder of JobRunr, on their ambitious new JavaClaw-like agent runtime

Hi Spring fans! In this installment, I talk to my friend and JobRunr founder Ronald Dehuysser about the latest and greatest, and their new "JavaClaw" project!...

Spring gRPC SecurityContext leaks across requests on authorization failure

When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions...

Spring gRPC AuthenticationException message reflected to remote client

The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks...

This Week in Spring - April 28th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! As I write this, I'm on PTO in beautiful Santorini, Greece, catching up on some news and about to cruise the islands for some sightseeing. There's nothing quite like springtime in the Mediterranean! I couldn't dream of enjoyin...

ONNX model cache defaults to world-writable predictable /tmp directory

In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Only applications that use TransformersEmbeddingModel and have the cache enabled, using the default location, are affected...

VectorStore FilterExpression Converter injection

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Only applications that use...

OOM by attacker-controlled PDF

In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by ForkPDFLayoutTextStripper . Only applications that use ForkPDFLayoutTextStripper and pass user-supplied input to DocumentReader s are affected...

VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId . Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input ...

SQL Injection in CosmosDBVectorStore.doDelete()

SQL injection vulnerability in Spring AI's CosmosDBVectorStore allows attackers to execute arbitrary SQL queries via crafted document IDs. Only applications that use CosmosDBVectorStore and pass user-supplied input as document ids are affected...

Elasticsearch auto-configuration with an SSL bundle disables TLS hostname verification

When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server...

DevTools remote secret comparison is vulnerable to timing attacks

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading changed classes, thereby achieving remote code executio...

A Bootiful Podcast: A Bootiful Podcast: Dr. Venkat Subramaniam and James Ward on Intelligent Kotlin and So Much More

I am beyond thrilled that I got to co-present with two legends, Dr. Venkat Subramaniam and James Ward, at Voxxed Days Amsterdam, and even more so that they both sat down for a quick discussion with me right before that presentation. Enjoy!...

Cassandra SSL auto-configuration disables TLS hostname verification

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra...

RabbitMQ auto-configuration with an SSL bundle disables TLS hostname verification

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker...

Random value property source uses a weak PRNG unsuitable for secrets

Values produced by $random.value are not suitable for use as secrets. $random.uuid is not affected. $random.int and $random.long should never be used for secrets as they are numeric values with a predictable range...