Spring vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-59324 When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageCHigh 8.2 · Aug 27, 2026
• CVE-2026-59316 Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding.High 8.2 · Aug 27, 2026
• CVE-2026-59313 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).Critical 9.8 · Aug 27, 2026
• CVE-2026-59307 An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed beanHigh 8 · Aug 27, 2026
• CVE-2026-59289 Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repositorHigh 7.5 · Aug 27, 2026
• CVE-2026-59288 The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application.High 7.4 · Aug 27, 2026
• CVE-2026-59286 The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks.High 8.1 · Aug 27, 2026
• CVE-2026-59285 Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.High 8.1 · Aug 27, 2026
• CVE-2026-59284 There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.High 7.6 · Aug 27, 2026
• CVE-2026-59283 Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL Critical 9.1 · Aug 27, 2026
• CVE-2026-59282 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a DeHigh 7.5 · Aug 27, 2026
• CVE-2026-59270 Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all availCritical 9.4 · Aug 27, 2026
• CVE-2026-47893 A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception rHigh 7.5 · Aug 27, 2026
• CVE-2026-47892 A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.Critical 9.8 · Aug 27, 2026
• CVE-2026-47891 A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.Critical 9.8 · Aug 27, 2026
• CVE-2026-47890 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.Critical 9.8 · Aug 27, 2026
• CVE-2026-47889 A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.High 7.5 · Aug 27, 2026
• CVE-2026-47888 A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.High 7.5 · Aug 27, 2026
• CVE-2026-47886 Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operHigh 7.5 · Aug 27, 2026
• CVE-2026-47885 The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1.High 7.5 · Aug 27, 2026
• CVE-2026-47884 Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where Critical 9.8 · Aug 27, 2026
• CVE-2026-47879 Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor.High 7.7 · Aug 27, 2026
• CVE-2026-47877 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.High 8.2 · Aug 27, 2026
• CVE-2026-47849 Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requesHigh 7.1 · Aug 27, 2026
• CVE-2026-47852 A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.High 7.5 · Aug 26, 2026