Spring Spring Framework
45 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-59314 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Spring Framework response splitting in ContentDisposition | LOW 3.7 | 0.3 % | ||
| CVE-2026-59313 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Server Sent Event stream corruption in Spring MVC functional web framework | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-59283 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Spring Framework Safety Guard Bypass via SpEL Expression Compilation | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-59282 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Spring Framework Denial of Service via Unbounded List Growth in Data Binding | HIGH 7.5 | 0.5 % | ||
| CVE-2026-59281 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Spring Framework Cross-site Scripting via EscapedErrors | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-59280 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Spring Framework Path Traversal via Backslash in SpringTemplateLoader | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-47893 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService | HIGH 7.5 | 0.5 % | ||
| CVE-2026-47892 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-47891 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-47890 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 | Spring Framework Server Sent Event stream corruption while rendering fragments | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-47889 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 | Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse | HIGH 7.5 | 0.4 % | ||
| CVE-2026-47888 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler | HIGH 7.5 | 0.5 % | ||
| CVE-2026-47887 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Spring Framework Open Redirect in UrlFileNameViewController | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-47886 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions | HIGH 7.5 | 0.5 % | ||
| CVE-2026-47885 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 | Spring Framework maxPartSize Ignored in PartEventHttpMessageReader | HIGH 7.5 | 0.4 % | ||
| CVE-2026-47884 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 ; 6.1.0 – 6.1.28 ; … | Spring Framework Improper Path Limitation in XsltView | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-47883 | 7.0.0 – 7.0.8 ; 6.2.0 – 6.2.19 | Spring Framework Open Redirect in UrlHandlerFilter | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-41855 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Unsafe Deserialization via Jackson JMS Converters | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-41854 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 | Spring Framework Server-Side Request Forgery via UriComponentsBuilder | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-41853 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-41852 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Arbitrary Method Invocation in SpEL Expressions | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-41851 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Denial of Service via Unbounded Cache in SpEL | HIGH 7.5 | 0.4 % | ||
| CVE-2026-41850 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Algorithmic Denial of Service via SpEL Expressions | HIGH 7.5 | 0.4 % | ||
| CVE-2026-41849 | 5.3.0 – < 5.3.49 | Spring Framework Denial of Service via Integer Overflow in SpEL Expressions | HIGH 7.5 | 0.3 % | ||
| CVE-2026-41848 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Denial of Service via AntPathMatcher | HIGH 7.5 | 0.3 % | ||
| CVE-2026-41847 | 5.3.0 – < 5.3.49 | Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-41846 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Cross-site Scripting via JSP Form Tags | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-41845 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Cross-site Scripting via JavaScriptUtils | HIGH 7.1 | 0.2 % | ||
| CVE-2026-41844 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Open Redirect in Spring MVC and WebFlux | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-41843 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-41842 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux | HIGH 7.5 | 0.4 % | ||
| CVE-2026-41841 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-41840 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-41839 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Escalation via Session Fixation in WebFlux | MEDIUM 4.2 | 0.2 % | ||
| CVE-2026-41838 | 7.0.0 – < 7.0.7.1 ; 6.2.0 – < 6.2.18.1 ; 6.1.0 – < 6.1.28 ; … | Spring Framework Predictable Session ID in WebSocket Module | HIGH 7.5 | 0.2 % | ||
| CVE-2026-22737 | 7.0.0 – 7.0.5 ; 6.2.0 – 6.2.16 ; 6.1.0 – 6.1.25 ; … | Spring Framework Improper Path Limitation with Script View Templates | MEDIUM 5.9 | 0.4 % | ||
| CVE-2025-22233 | 6.2.0 – 6.2.6 ; 6.1.0 – 6.1.19 ; 6.0.0 – 6.0.27 ; … | Spring Framework DataBinder Case Sensitive Match Exception | LOW 3.1 | 0.4 % | ||
| CVE-2024-38808 | 5.3.0 – < 5.3.39, 6.0+ | CVE-2024-38808: Spring Expression DoS Vulnerability | MEDIUM 4.3 | 0.6 % | ||
| CVE-2024-22262 | 6.1.x – < 6.1.6 ; 6.0.x – < 6.0.19 ; 5.3.x – < 5.3.34 | CVE-2024-22262: Spring Framework URL Parsing with Host Validation | HIGH 8.1 | 1.2 % | ||
| CVE-2024-22259 | 6.1.x – < 6.1.5 ; 6.0.x – < 6.0.18 ; 5.3.x – < 5.3.33 | CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report) | HIGH 8.1 | 2.6 % | ||
| CVE-2024-22243 | 6.0.x – < 6.0.17 ; 6.1.x – < 6.1.4 ; 5.3.x – < 5.3.32 | CVE-2024-22243: Spring Framework URL Parsing with Host Validation | HIGH 8.1 | 4.0 % | ||
| CVE-2024-22233 | 6.1.2 ; 6.0.15 | CVE-2024-22233: Spring Framework server Web DoS Vulnerability | HIGH 7.5 | 1.0 % | ||
| CVE-2023-34053 | 6.0.0 – < 6.0.14 | Spring Framework server Web Observations DoS Vulnerability | HIGH 7.5 | 1.2 % | ||
| CVE-2020-5397 | 5.2 – < v5.2.3.RELEASE | CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux | MEDIUM 5.3 | 2.6 % | ||
| CVE-2020-5398 | 5.0 – < v5.0.16.RELEASE ; 5.1 – < v5.1.13.RELEASE ; 5.2 – < v5.2.3.RELEASE | RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application | HIGH 8.0 | 88 % |