VMware Spring Framework
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-22745 | 7.0.0 – < 7.0.7 ; 6.2.0 – < 6.2.18 ; 6.1.0 – < 6.1.27 ; … | CVE-2026-22745 : Denial of service in static resource handling on Windows platforms | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-22741 | 7.0.0 – < 7.0.7 ; 6.2.0 – < 6.2.18 ; 6.1.0 – < 6.1.27 ; … | Static resource cache poisoning in Spring MVC and WebFlux | LOW 3.1 | 0.2 % | ||
| CVE-2026-22740 | 7.0.0 – < 7.0.7 ; 6.2.0 – < 6.2.18 ; 6.1.0 – < 6.1.27 ; … | Spring Framework DoS with Multipart Temp Files in WebFlux | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-41254 | 5.3.x ; 6.0.x ; 6.1.x ; … | Spring Framework STOMP CSRF Vulnerability | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-41249 | 6.2.x – < 6.2.11 ; 6.1.x – < 6.1.23 ; 5.3.x – < 5.3.45 | CVE-2025-41249: Spring Framework Annotation Detection Vulnerability | HIGH 7.5 | 0.5 % | ||
| CVE-2025-41242 | 6.2.x – < 6.2.10 ; 6.1.x – < 6.1.22 ; 5.3.x – < 5.3.44 | CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers | MEDIUM 5.9 | 2.1 % | ||
| CVE-2025-41234 | 6.0.5 – 6.0.28 ; 6.1.0 – 6.1.20 ; 6.2.0 – 6.2.7 | RFD Attack via “Content-Disposition” Header Sourced from Request | MEDIUM 6.5 | 0.6 % |