Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 197

Export CSV
CVE-2026-59300

Potential for logging sensitive data in Spring Cloud Function AWS

Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Cloud Function Spring Cloud Function
CVE-2026-59322

EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Integration Spring Integration
CVE-2026-59324

fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Integration Spring Integration
CVE-2026-47892

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-47893

Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-47881

Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.0 - 5.2.6 Spring Batch 4.3.0 - 4.3.13

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Spring
Products
Spring Batch Spring Batch
CVE-2026-59271

Admin password disclosed in BrokerNotAliveException message

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Amqp Spring Advanced Message Queuing Protocol
CVE-2026-59274

Unbounded decompression in UnZipTransformer enables zip-bomb DoS

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Integration Spring Integration
CVE-2026-59275

Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Amqp Spring Advanced Message Queuing Protocol
CVE-2026-59288

Spring for GraphQL Information Exposure in GraphiQL support

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring For Graphql Spring For Graphql
CVE-2026-59278

In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring For Apache Kafka Spring For Apache Kafka
CVE-2026-59272

Log4j2 AmqpAppender disables TLS hostname verification by default

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Amqp Spring Advanced Message Queuing Protocol
CVE-2026-59280

Spring Framework Path Traversal via Backslash in SpringTemplateLoader

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-59314

Spring Framework response splitting in ContentDisposition

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-59284

Spring Cloud Commons no allow list for writable env actuator endpoint

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Spring
Products
Spring Cloud Commons Spring Cloud Commons
CVE-2026-59283

Spring Framework Safety Guard Bypass via SpEL Expression Compilation

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-59316

Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Broadcom Spring
Products
Spring Authorization Server Spring Authorization Server
CVE-2026-59315

Spring Cloud Config Monitor Denial of Service

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Cloud Config Spring Cloud Config
CVE-2026-59294

Arbitrary File Write via Path Traversal in ResourceCacheService

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.9 and earlier

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Ai Spring Ai
CVE-2026-59293

SMB minimum protocol dialect defaults to SMB1

Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Integration Spring Integration