CVE-2026-47890

Spring Framework Server Sent Event stream corruption while rendering fragments

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Framework Spring Framework

CVE-2026-47891

Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Framework Spring Framework

CVE-2026-59297

Spring Cloud Function can incorrectly determine if URI is secure

Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Cloud Function Spring Cloud Function

CVE-2026-59289

Spring for GraphQL Denial of Service via pagination support

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring For Graphql Spring For Graphql

CVE-2026-59287

Spring for GraphQL WebSocket Client Denial of Service

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring For Graphql Spring For Graphql

CVE-2026-59282

Spring Framework Denial of Service via Unbounded List Growth in Data Binding

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Framework Spring Framework

CVE-2026-59281

Spring Framework Cross-site Scripting via EscapedErrors

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Framework Spring Framework

CVE-2026-59277

Spring Security InetAddressMatchers Incomplete Internal Network Classification

Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Security Spring Security

CVE-2026-59276

Timing Attack via Non-Constant-Time Comparison of Sensitive Values

Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Security Spring Security

CVE-2026-47860

Unbounded decompression of attacker-supplied compressed message bodies

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Amqp Spring Advanced Message Queuing Protocol

CVE-2026-47861

UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Integration Spring Integration

CVE-2026-47862

ZipTransformer uses file_name header to build workDirectory path without sanitization

An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Integration Spring Integration

CVE-2026-47849

Spring Data REST allows mutation of identifier and version properties via JSON Patch

Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Data Rest Spring Data Rest

CVE-2026-47864

Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS 3.1 · 6.4 Medium EPSS 5.9% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Integration Spring Integration

CVE-2026-47875

JobParameterDeserializer bypasses the trusted-type allowlist

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Spring

Products

Spring Batch Spring Batch

CVE-2026-47877

Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Security Spring Security

CVE-2026-47894

Spring Cloud Config Server Native Environment Repository Exposure

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Cloud Config Spring Cloud Config

CVE-2026-59270

Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Security Spring Security

CVE-2026-59298

Potential for improper filtering of HTTP headers in Spring Cloud Function

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Cloud Function Spring Cloud Function

CVE-2026-59299

Composition lookup can potentially poison base function in Spring Cloud Function

Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Cloud Function Spring Cloud Function