CVE-2022-22965

CVE-2022-22965 (Spring4Shell) affects Spring Framework’s Spring MVC and Spring WebFlux when data binding is enabled in apps running on JDK 9+, with exploitation requiring Tomcat as WAR deployment. The issue is not exploited in Spring Boot executable jars. Vulnerable configurations are associated ...

CVE-2022-22950

CVE-2022-22950 affects Spring Framework 5.3.0–5.3.16 and older unsupported versions, where a specially crafted SpEL expression may cause a Denial of Service. The connected advisories corroborate the DoS vector via Spring Expression language handling, and indicate a fix is available in newer branc...

CVE-2016-1000027

CVE-2016-1000027 involves remote code execution in Pivotal Spring Framework when deserializing untrusted data. Connected sources specify impact up to Spring Framework 5.3.16 (RCE via Java deserialization) and note that the vendor discourages untrusted-deserialization usage. Remediation guidance i...

CVE-2024-22259

CVE-2024-22259 affects Spring Framework’s UriComponentsBuilder when parsing an externally provided URL and validating its host, potentially enabling open redirect or SSRF if the URL is used after validation. The CVE has CVSS 3.1 base score 8.1 (HIGH). Connected advisories from Atlassian/Broadcom ...

CVE-2026-47884

The Spring Framework is vulnerable to Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE) due to the use of XsltView in Spring MVC applications. The issue occurs when an application possesses an "/ " mapping** that results in view rendering where the view name is not explicitly spe...

CVE-2026-22741

CVE-2026-22741 – cache poisoning in static resources (Spring MVC/WebFlux) . When an app uses Spring MVC/WebFlux with resource chain caching enabled and encoded resource resolution, and the resource cache is empty, an attacker can poison the cache by sending crafted requests with incorrect encodin...

CVE-2022-22968

CVE-2022-22968 affects Spring Framework where DataBinder’s disallowedFields patterns are case sensitive in versions 5.3.0–5.3.18, 5.2.0–5.2.20, and older unsupported releases. The issue means a field is not fully protected unless every first character (and nested path) is listed in both uppercase...

CVE-2026-59283

Applications evaluating Spring Expression Language (SpEL) expressions using SimpleEvaluationContext are vulnerable to a safety guard bypass when the SpEL expression compiler is active. This issue affects multiple versions of the Spring Framework , including versions 7.0.0-7.0.8 , 6.2.0-6.2.19 , 6...

CVE-2018-1270

Summary: CVE-2018-1270 affects Spring Framework versions 5.0.x before 5.0.5 and 4.3.x before 4.3.15 (and older unsupported) via the spring-messaging module, which can expose STOMP over WebSocket endpoints to a simple in-memory broker. A malicious actor can craft a message to the broker that leads...

CVE-2020-5421

CVE-2020-5421 affects Spring Framework releases across multiple lines (5.2.x to 5.0.x, 4.3.x and older). The issue arises from improper input handling of the jsessionid path parameter, which may bypass RFD Protection and weaken security controls. Affected products reference VMware Tanzu Spring Fr...

CVE-2026-22740

The CVE-2026-22740 issue affects Spring Framework WebFlux multipart request handling. The root cause is cleanup of temporary files created for parts larger than 10 KB, which in some cases are not deleted after the request completes, enabling an attacker to exhaust disk space (Denial of Service). ...

CVE-2026-59282

Applications using the Spring Framework data binding infrastructure are vulnerable to a Denial of Service (DoS) attack. The root cause is the application's ability to apply user-supplied property paths onto a target object. Affected versions include 7.0.0 - 7.0.8 , 6.2.0 - 6.2.19 , 6.1.0 - 6.1.28...

CVE-2026-47886

Applications evaluating user-supplied Spring Expression Language (SpEL) expressions are vulnerable to a Denial of Service (DoS) attack. The root cause is the use of the power operator (^) with BigDecimal or BigInteger operands and a large exponent value. Affected Spring Framework versions include...

CVE-2018-11039

CVE-2018-11039 affects the Spring Framework, where the HiddenHttpMethodFilter in Spring MVC allows web apps to change the HTTP request method to any method (including TRACE). This can enable an attacker with an existing XSS vulnerability to escalate to an XST (Cross Site Tracing) attack. Affected...

CVE-2026-22735

CVE-2026-22735 affects Spring MVC and Spring WebFlux applications via Server-Sent Events (SSE) stream handling. Concrete details in the connected documents show impact on Spring Framework components: Spring Foundation versions 5.3.0–5.3.46, 6.1.0–6.1.25, 6.2.0–6.2.16, and 7.0.0–7.0.5 experience s...

CVE-2026-47893

A Spring WebFlux application supporting WebSocket connections may expose indirectly sensitive user information because request headers are included in an exception reason. Affected versions include Spring Framework 7.0.0 - 7.0.8 , 6.2.0 - 6.2.19 , 6.1.0 - 6.1.28 , 6.0.0 - 6.0.30 , 5.3.0 - 5.3.49 ...

CVE-2026-41839

The CVE-2026-41839 affects Spring Framework WebFlux. A WebFlux application with a compromised subdomain (e.g., via XSS) is vulnerable to an escalation attack that exchanges a known session ID for that of an authenticated user. Affected versions are: Spring Framework 7.0.0–7.0.7; 6.2.0–6.2.18; 6.1...

CVE-2026-22737

CVE-2026-22737 affects Spring Framework components that render script template views via a Java scripting engine (e.g., JRuby, Jython) in Spring MVC and Spring WebFlux. The issue allows disclosure of content from files outside configured script template view locations due to the scripting engine ...

CVE-2026-59281

A flaw in Spring MVC and WebFlux applications allows for arbitrary HTML/JavaScript code injection when data-binding Errors instances with HTML escaping enabled are rendered using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors. This can lead to reflected cross-site scr...

CVE-2018-1257

CVE-2018-1257 affects Spring Framework: vulnerable in Spring Messaging when using an in-memory STOMP broker exposed via STOMP over WebSocket. A malicious user can craft a message to the broker that triggers a regular-expression denial of service. Affected versions are Spring Framework 5.0.x befor...

CVE-2026-59280

Applications utilizing Spring Framework 's FreeMarker integration may be susceptible to a path traversal attack. The vulnerability occurs when a controller returns a view name derived from untrusted input while FreeMarker is configured to resolve templates via SpringTemplateLoader . A remote atta...

CVE-2018-11040

CVE-2018-11040 affects Spring Framework: 5.0.x before 5.0.7 and 4.3.x before 4.3.18 (and older unsupported versions). The issue arises because JSONP support can be enabled via JSONP parameters when MappingJackson2JsonView is configured, allowing cross-domain requests through AbstractJsonpResponse...

CVE-2026-47891

A Spring WebFlux application is vulnerable because it fails to correctly enforce the maxInMemorySize limit when using the Aalto XML processor to parse XML input. This issue affects multiple versions, including Spring Framework 7.0.0 - 7.0.8 , 6.2.0 - 6.2.19 , 6.1.0 - 6.1.28 , 6.0.0 - 6.0.30 , 5.3...

CVE-2026-22745

The vulnerability is in the Spring Framework’s static resource resolution when serving file-system backed resources in Spring MVC/WebFlux apps on Windows. Affected component: org.springframework:spring-core. Under the conditions that the app uses Spring MVC or Spring WebFlux, serves static resour...

CVE-2026-47887

A Spring MVC application is vulnerable to an open redirect when using UrlFileNameViewController that is mapped with an end-of-path and lacks a configured prefix. This vulnerability affects several versions, including Spring Framework 7.0.0 - 7.0.8 , 6.2.0 - 6.2.19 , 6.1.0 - 6.1.28 , 6.0.0 - 6.0.3...