Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 211

Export CSV
CVE-2026-40994

Wss4jSecurityInterceptor disables WS-I BSP validation by default

Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Broadcom Spring
Products
Spring Web Services Spring Web Services
CVE-2026-40995

X.509 authentication bypasses Spring Security account checks

X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts). Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Spring
Products
Spring Web Services Spring Web Services
CVE-2026-40996

Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default

Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS#1 v1.5 (rsa-1_5) encrypted key material unless operators explicitly reconfigured the flag. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Spring
Products
Spring Web Services Spring Web Services
CVE-2026-40997

SOAP security faults leak Spring Security account state

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote attackers in distinguishing valid accounts from invalid ones and inferring lifecycle state. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Spring
Products
Spring Web Services Spring Web Services
CVE-2026-59355

Spring Authorization Server: Open Redirect via request_uri parameter

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Spring
Products
Spring Authorization Server Spring Authorization Server
CVE-2026-59285

Spring for GraphQL Unsafe Deserialization in pagination support

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring For Graphql Spring For Graphql
CVE-2026-59286

Spring for GraphQL loads Untrusted Resources in GraphiQL support

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring For Graphql Spring For Graphql
CVE-2026-47890

Spring Framework Server Sent Event stream corruption while rendering fragments

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-47891

Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-59297

Spring Cloud Function can incorrectly determine if URI is secure

Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Cloud Function Spring Cloud Function
CVE-2026-59289

Spring for GraphQL Denial of Service via pagination support

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.2.0 - 1.3.9

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring For Graphql Spring For Graphql
CVE-2026-59287

Spring for GraphQL WebSocket Client Denial of Service

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring For Graphql Spring For Graphql
CVE-2026-59282

Spring Framework Denial of Service via Unbounded List Growth in Data Binding

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-59281

Spring Framework Cross-site Scripting via EscapedErrors

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-59277

Spring Security InetAddressMatchers Incomplete Internal Network Classification

Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. Spring Security 7.1.0

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Security Spring Security
CVE-2026-59276

Timing Attack via Non-Constant-Time Comparison of Sensitive Values

Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Security Spring Security
CVE-2026-47860

Unbounded decompression of attacker-supplied compressed message bodies

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Amqp Spring Advanced Message Queuing Protocol
CVE-2026-47861

UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Integration Spring Integration
CVE-2026-47862

ZipTransformer uses file_name header to build workDirectory path without sanitization

An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Integration Spring Integration
CVE-2026-47874

Reactor Netty HTTP Server Denial of Service With Pipelined Requests

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pivotal Spring
Products
Reactor Netty Reactor Netty