Denial-Of-Service (DoS)

io.micrometer, micrometer-tracing-bridge-brave is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of incoming baggage headers, which allows an attacker to send specially crafted or excessive baggage data that causes unbounded object allocation, potentially...

Man-in-the-Middle

Spring Integration is vulnerable to Man-in-the-Middle attacks. The vulnerability is due to the jCIFS client negotiating down to SMB1/CIFS unless the application explicitly raises smbMinVersion, where SMB1/CIFS lacks mandatory signing/encryption and attackers can perform NTLM relay and...

Improper Handling Of Untrusted Message Headers

Spring Integration is vulnerable to improper handling of untrusted message headers. The vulnerability is due to the EmbeddedHeadersJsonMessageMapper deserializing embedded JSON headers into a Map and creating message headers without sanitizing or filtering untrusted header names by default, which...

Denial Of Service

Spring Integration is vulnerable to Denial of Service. The vulnerability is due to the UnZipTransformer not limiting decompressed entry size or entry count when processing archives, where an attacker can send a crafted zip archive that exhausts JVM heap memory and causes a denial-of-service outag...

Open Redirect

Spring Authorization Server is vulnerable to open redirect. The vulnerability is due to insufficient validation of the requesturi parameter, where the authorization endpoint allows an attacker to craft a request containing an invalid requesturi paired with an unvalidated redirecturi, resulting in...

Improper Input Validation

Spring for Apache Kafka is vulnerable to an integer parsing denial-of-service. The vulnerability is due to the application passing attacker-controlled header bytes directly to BigInteger without length or format validation, which allows an attacker to exploit the issue by supplying a maliciously...

Denial-of-Service (DoS)

Spring Cloud Config is vulnerable to a Denial-of-Service DoS. The vulnerability is due to the Spring Cloud Config Monitor processing maliciously crafted payloads, which allows an attacker to send specially crafted requests that can exhaust application resources and cause the affected service to...

Arbitrary Local File Read

NLTK is vulnerable to an Arbitrary Local File Read. The vulnerability is due to StreamBackedCorpusView directly calling builtins.open instead of the security-enforcing pathsec.open, which allows an attacker who controls the fileid argument to bypass the ENFORCE setting and read arbitrary local...

Deserialization Protection Bypass

org.springframework.integration, spring-integration-jdbc is vulnerable to a deserialization protection bypass. The vulnerability is due to JdbcMessageStore.addAllowedPatterns... providing no effective protection when the store is configured as a Spring-managed bean, which allows an attacker to...

RediSearch Injection

Spring AI is vulnerable to RediSearch Injection. The vulnerability is due to RedisChatMemoryRepository.findByMetadata using unsanitized metadata values in RediSearch queries, allowing an attacker to inject RediSearch syntax and retrieve chat messages across conversations...

Server-Side Request Forgery (SSRF)

NLTK is vulnerable to a Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the destination when an HTTP proxy is configured, which allows an attacker to provide a validated public URL that the proxy redirects to an internal service, potentially exposing internal...

Path Traversal

NLTK is vulnerable to a path traversal. The vulnerability is due to insufficient validation of selectors or poisoned index state in FramenetCorpusReader and NKJPCorpusReader, which allows an attacker to supply crafted parameters to methods such as framebyname, doc, lu, and header to access and...

Denial Of Service (DoS)

Netty is vulnerable to Denial of Service DoS. The vulnerability is due to inefficient quadratic CPU processing when aggregating large TLS ClientHello messages split across many small records, which allows an unauthenticated remote attacker to consume excessive CPU resources and degrade TLS handli...

Improper Authorization

Netty is vulnerable to Improper Authentication. The vulnerability is due to incorrect offset validation when processing fragmented TLS ClientHello handshake headers, which allows an unauthenticated remote attacker to bypass SNI-specific mutual TLS authentication when no additional certificate...

Prototype Pollution

node-csv is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of duplicate proto CSV headers when columns and groupcolumnsbyname are enabled, which allows an attacker to inject an attacker-controlled array into the parsed record's prototype and manipulate inherited...

Deserialization Of Untrusted Data

Spring for Apache Kafka is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper trusting java.net packages by default, which allows an external Kafka producer to inject malicious java.net.InetAddress types through the...

Denial Of Service (DoS)

Spring AMQP is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of a malicious AMQP message that can terminate the entire consumer JVM using System.exit99, which allows an attacker to cause complete availability loss for all workloads running in the affected...

Directory Traversal

Spring Cloud Config is vulnerable to Directory Traversal. The vulnerability is due to improper restriction of configuration file access in the native environment repository, which allows an attacker to access configuration files outside the configured repository path...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service DoS. The vulnerability is due to the Aalto XML processor not correctly enforcing the maxInMemorySize limit when parsing XML input, which allows an attacker to provide oversized XML data that consumes excessive memory and potentially causes a...

Open Redirect

Spring Framework is vulnerable to Open Redirect. The vulnerability is due to improper handling of URLs by UrlFileNameViewController when mapped with an end-of-path and no configured prefix, which allows an attacker to craft a malicious URL that redirects users to an attacker-controlled external...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial of Service DoS. The vulnerability is due to inefficient processing of the SpEL power operator ^ with BigDecimal or BigInteger operands and large exponent values, which allows an attacker to supply a crafted expression that consumes excessive CPU and memory...

Authorization Bypass

Spring Integration is vulnerable to Authorization Bypass. The vulnerability is due to JMS properties such as replyChannel, errorChannel, and jsonTypeId being copied without validation into Spring Integration MessageHeaders, which allows an attacker with JMS publish access to manipulate message...

Server-Side Request Forgery (SSRF)

Spring Cloud Gateway is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to JsonToGrpcGatewayFilterFactory allowing arbitrary Spring Resource locations for the proto descriptor, which allows an attacker to access or load unintended resources from the server...

Deserialization Of Untrusted Data

Spring Batch is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to DefaultExecutionContextSerializer passing Base64-decoded data directly to ObjectInputStream.readObject without an ObjectInputFilter, which allows an attacker to provide malicious serialized objects and...

Sensitive Data Exposure

org.springframework.cloud, spring-cloud-function-adapter-aws is vulnerable to sensitive data exposure. The vulnerability is due to sensitive information being included in application logs, which allows an attacker with access to the logs to obtain potentially confidential data...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service. The vulnerability is due to stream corruption when Server-Sent Events SSE are used with functional web framework applications in Spring MVC...

Base Function Poisoning

Spring Cloud Function is vulnerable to base function poisoning. The vulnerability is due to improper handling of function composition lookup, which allows an attacker to manipulate or poison the base function and potentially execute unintended function compositions...

Improper Input Validation

Micrometer is vulnerable to improper input validation. The vulnerability is due to the use of untrusted, non-normalized input for metric names, tag keys, and tag values, which allows an attacker to supply malicious or unexpected metrics data and potentially cause security or operational issues in...

Cache Leakage

Spring AI is vulnerable to cache leakage. The vulnerability is due to the context hash used in the Semantic Cache support to isolate cached responses between different system prompts, where the hash may not provide sufficient separation and attackers can cause cached responses from one context to...

Denial-Of-Service (DoS)

io.micrometer, micrometer-core is vulnerable to a denial-of-service DoS. The vulnerability is due to improper memory management that can cause memory to grow without bounds during outbound HTTP requests, which allows an attacker to exploit the condition by triggering a large number of HTTP reques...

Timing Attack

Spring Security is vulnerable to a timing attack. The vulnerability is due to the use of String.equals, which returns early when a character differs, causing response times to vary based on the number of matching leading characters and allowing an attacker to perform timing analysis to...

Insecure Deserialization

Spring Cloud Stream is vulnerable to insecure deserialization. The vulnerability is due to deserialization of untrusted types, where crafted serialized objects are deserialized without validation and attackers can supply malicious payloads to achieve code execution...

Man-In-The-Middle (MitM)

org.springframework.amqp, spring-rabbit is vulnerable to a man-in-the-middle MitM. The vulnerability is due to the Log4j2 appender relying on an insecure documented default TLS configuration, which allows an attacker capable of intercepting the TLS connection to perform a man-in-the-middle attack...

UnboundID LDAP Server Administrative Credential Exposure

Spring Security is vulnerable to an UnboundID LDAP Server Administrative Credential Exposure. The vulnerability is due to the embedded UnboundID LDAP server UnboundIdContainer unconditionally registering an administrative credential and binding its listener to all available network interfaces,...

Sensitive Information Disclosure

org.springframework, spring-webflux is vulnerable to sensitive information disclosure. The vulnerability is due to request headers being included in the exception reason when handling WebSocket connections, which allows an attacker to potentially obtain indirectly sensitive user information by...

Stream Corruption

Spring Framework is vulnerable to stream corruption. The vulnerability is due to improper handling of response streams when processing SSE with view fragments, which allows an attacker to potentially corrupt or disrupt the application’s HTTP response stream...

Open Redirect

Spring Framework is vulnerable to an open redirect. The vulnerability is due to insufficiently restrictive URL pattern matching, which allows an attacker to manipulate a URL and redirect a victim to an attacker-controlled external destination...

Cross-Site Scripting (XSS)

org.springframework.security, spring-security-oauth2-authorization-server is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the default consent page rendering user-controlled values without proper HTML entity encoding, which allows an attacker to inject malicious HTML or...

Denial-of-service (DoS)

io.projectreactor.netty, reactor-netty-http is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of multiple pipelined HTTP/1.1 requests over a single connection, which allows an attacker to send specially crafted requests that consume excessive memory and...

Improper Interceptor Addition

Spring Cloud Stream is vulnerable to improper interceptor addition. The vulnerability is due to an improperly added PartitionInterceptor while sending a message, where the interceptor is attached without adequate validation and attackers can send crafted messages to manipulate message routing or...

Denial-of-Service (DoS)

Reactor Core is vulnerable to a Denial-of-Service DoS. The vulnerability is due to improper handling of backpressure when the Flux.bufferTimeout operator is used with fair backpressure enabled, which allows an attacker to trigger excessive resource consumption and potentially exhaust application...

Deserialization Of Untrusted Data

Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to SerializingHttpMessageConverter deserializing HTTP request bodies using ObjectInputStream.readObject without class filtering, which allows an unauthenticated attacker to provide a crafted serialized...

Server-Side Request Forgery (SSRF)

Spring Integration is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of UDP inbound adapter requests, which allows an unauthenticated attacker to send a crafted UDP packet and cause the server to send UDP datagrams to arbitrary internal or...

Deserialization Of Untrusted Data

Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the jsonTypeId header being used to determine the deserialization target class without a type or package allow-list, which allows an attacker to specify a malicious class and potentially achieve...

Improper Access Control

Spring Data REST is vulnerable to Improper Access Control. The vulnerability is due to insufficient protection of identifier @Id and version @Version properties from mutation through RFC 6902 JSON Patch requests, which allows an attacker to modify these properties and potentially alter resource...

Improper Credential Management

Reactor Netty is vulnerable to Improper Credential Management. The vulnerability is due to credentials being forwarded during WebSocket handshake redirects to a different origin when redirects are explicitly enabled, which allows an attacker to intercept or obtain sensitive credentials...

Unbounded Cache Size

Spring Cloud Stream is vulnerable to an unbounded cache size. The vulnerability is due to improper bounding of the dynamic destination cache size, where the cache can grow without limit and attackers can trigger excessive memory usage to cause a denial‑of‑service condition...

Sensitive Data Logging

Spring Cloud Function is vulnerable to Sensitive Data Logging. The vulnerability is due to insufficient redaction of sensitive information in its logging mechanisms, where request or response data may be written to logs without filtering and attackers can trigger the function with secret‑containi...

Scheme Verification Bypass

Spring Cloud Function is vulnerable to Scheme Verification Bypass. The vulnerability is due to the implementation of the isSecure method in ServerlessHttpServletRequest not verifying the actual scheme, where the method can report a request as secure even when the scheme is not HTTPS and an attack...

Server-Side Request Forgery (SSRF)

Spring Cloud Function is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled file or resource paths, allowing an attacker to read arbitrary local files or make requests to attacker-controlled or internal resources...