https://cvebrief.com/archive/cves/vendor/spring/ High and critical Spring vulnerabilities covered by CVE Brief, with independent analyst commentary. en-us Thu, 03 Sep 2026 12:00:00 GMT https://cvebrief.com/cve/cve-2026-47889/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-47889 Thu, 03 Sep 2026 12:00:00 GMT A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-47893/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-47893 Thu, 03 Sep 2026 12:00:00 GMT A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-59282/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-59282 Wed, 02 Sep 2026 12:00:00 GMT Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-47886/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-47886 Tue, 01 Sep 2026 12:00:00 GMT Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-47892/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-47892 Tue, 01 Sep 2026 12:00:00 GMT Spring Framework is susceptible to a header predicate bypass in pre-flight requests when using WebFlux functional endpoints with DispatcherServlet, potentially allowing unauthorized access. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-59283/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-59283 Tue, 01 Sep 2026 12:00:00 GMT A safety guard bypass vulnerability in Spring Framework allows unauthenticated attackers to manipulate SpEL expressions when the compiler is active, potentially leading to unauthorized data integrity loss. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-59313/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-59313 Tue, 01 Sep 2026 12:00:00 GMT Spring MVC applications using the functional web framework are vulnerable to stream corruption via CRLF injection when utilizing Server-Sent Events (SSE). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-47877/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-47877 Fri, 28 Aug 2026 12:00:00 GMT Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-47884/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-47884 Fri, 28 Aug 2026 12:00:00 GMT An unauthenticated SSRF and RCE vulnerability exists in Spring MVC applications using XsltView with specific wildcard view rendering configurations. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-47890/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-47890 Fri, 28 Aug 2026 12:00:00 GMT Spring MVC and WebFlux applications are susceptible to stream corruption via CRLF injection when utilizing Server-Sent Events with view fragments. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-47891/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-47891 Fri, 28 Aug 2026 12:00:00 GMT The Spring WebFlux component fails to enforce memory limits when using the Aalto XML processor, allowing for potential resource exhaustion. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-59316/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-59316 Fri, 28 Aug 2026 12:00:00 GMT Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-59324/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-59324 Fri, 28 Aug 2026 12:00:00 GMT When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-59279/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-59279 Sun, 23 Aug 2026 12:00:00 GMT The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated Fix documented (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-47873/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-47873 Thu, 30 Jul 2026 12:00:00 GMT The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0 Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-47882/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-47882 Thu, 30 Jul 2026 12:00:00 GMT When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed applica Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-41862/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-41862 Wed, 24 Jun 2026 12:00:00 GMT Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application Fix documented: 4.0.1.1 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-47825/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-47825 Tue, 16 Jun 2026 12:00:00 GMT Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios Fix documented: 3.1.13 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-47835/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-47835 Tue, 16 Jun 2026 12:00:00 GMT In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB Fix documented: 1.0.9 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-41699/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-41699 Sun, 14 Jun 2026 12:00:00 GMT Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries Fix documented: 2.0.3.1 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-41700/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-41700 Sun, 14 Jun 2026 12:00:00 GMT Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking Fix documented: 2.0.3.1 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40994/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-40994 Fri, 12 Jun 2026 12:00:00 GMT Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData Fix documented: 5.0.1.1 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40998/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-40998 Fri, 12 Jun 2026 12:00:00 GMT Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration Fix documented: 5.0.1.1 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40999/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-40999 Thu, 11 Jun 2026 12:00:00 GMT When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to c Fix documented: 5.0.1.1 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-41855/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-41855 Tue, 09 Jun 2026 12:00:00 GMT In an untrusted JMS environment, org Fix documented: 7.0.7.1 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-41705/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-41705 Sat, 09 May 2026 12:00:00 GMT Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs Fix documented: 1.0.7 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40982/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-40982 Thu, 07 May 2026 12:00:00 GMT Spring Cloud Config allows directory traversal via specially crafted URLs, enabling unauthorized access to arbitrary files. Fix documented: 3.1.14 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40978/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-40978 Wed, 29 Apr 2026 12:00:00 GMT SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs Fix documented: 1.0.6 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40967/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-40967 Tue, 28 Apr 2026 12:00:00 GMT In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages Fix documented: 1.0.6 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40972/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-40972 Tue, 28 Apr 2026 12:00:00 GMT An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret Fix documented: 4.0.6 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-40976/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-40976 Tue, 28 Apr 2026 12:00:00 GMT In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. Fix documented: 4.0.6 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-22753/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-22753 Thu, 23 Apr 2026 12:00:00 GMT Vulnerability in Spring Spring Security Fix documented: 7.0.5 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-22738/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-22738 Fri, 27 Mar 2026 12:00:00 GMT Spring AI versions prior to 1.0.5 and 1.1.4 are vulnerable to SpEL injection in SimpleVectorStore when user-supplied input is used as a filter expression key, leading to remote code execution. Fix documented: 1.0.5 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-22742/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-22742 Fri, 27 Mar 2026 12:00:00 GMT Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs Fix documented: 1.0.5 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-22739/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-22739 Tue, 24 Mar 2026 12:00:00 GMT Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories Fix documented: 3.1.13 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-22731/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-22731 Fri, 20 Mar 2026 12:00:00 GMT Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path Fix documented: 4.0.3 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-22733/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2026-22733 Fri, 20 Mar 2026 12:00:00 GMT Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints Fix documented: 4.0.4 (OSV.dev). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-41243/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-spring-CVE-2025-41243 Tue, 16 Sep 2025 12:00:00 GMT Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. Fix documented: 4.3.1 (CVE record). Independent analyst report on CVE Brief.