Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 89

Export CSV
CVE-2022-22971

springframework: DoS with STOMP over WebSocket

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Netapp Oracle Redhat and 1 more
Products
Cloud Secure Agent Oncommand Insight Financial Services Crime And Compliance Management Studio and 3 more
CVE-2020-5398

RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

CVSS 3.1 · 7.5 High EPSS 88.3% KEV · Not listed
Vendors
Netapp Oracle Redhat and 1 more
Products
Data Availability Services Snapcenter Application Testing Suite and 31 more
CVE-2018-1270

spring-framework: Possible RCE via spring messaging

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.

CVSS 3.1 · 9.8 Critical EPSS 77.6% KEV · Not listed
Vendors
Debian Oracle Redhat and 1 more
Products
Debian Linux Application Testing Suite Big Data Discovery and 26 more
CVE-2018-1257

spring-framework: ReDoS Attack with spring-messaging

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.

CVSS 3.1 · 6.5 Medium EPSS 3.0% KEV · Not listed
Vendors
Oracle Redhat Vmware
Products
Agile Product Lifecycle Management Application Testing Suite Big Data Discovery and 29 more
CVE-2018-15756

DoS Attack via Range Requests

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.

CVSS 3.1 · 7.5 High EPSS 8.8% KEV · Not listed
Vendors
Debian Oracle Redhat and 1 more
Products
Debian Linux Agile Product Lifecycle Management Communications Brm - Elastic Charging Engine and 39 more
CVE-2018-11040

springframework: cross-domain requests via JSONP through AbstractJsonpResponseBodyAdvice

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Debian Oracle Vmware
Products
Debian Linux Agile Product Lifecycle Management Application Testing Suite and 25 more
CVE-2018-11039

springframework: Cross Site Tracing (XST) if vulnerable to XSS

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.

CVSS 3.1 · 5.9 Medium EPSS 2.8% KEV · Not listed
Vendors
Debian Oracle Vmware
Products
Debian Linux Agile Product Lifecycle Management Application Testing Suite and 30 more
CVE-2022-22970

springframework: DoS via data binding to multipartFile or servlet part

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

CVSS 3.1 · 5.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Netapp Oracle Redhat and 1 more
Products
Active Iq Unified Manager Brocade San Navigator Cloud Secure Agent and 5 more
CVE-2022-22968

Framework: Data Binding Rules Vulnerability

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

CVSS 3.1 · 5.3 Medium EPSS 5.7% KEV · Not listed
Vendors
Netapp Oracle Redhat and 1 more
Products
Active Iq Unified Manager Cloud Secure Agent Metrocluster Tiebreaker and 6 more
CVE-2020-5421

RFD Protection Bypass via jsessionid

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

CVSS 3.1 · 6.5 Medium EPSS 11.6% KEV · Not listed
Vendors
Netapp Oracle Redhat and 1 more
Products
Oncommand Insight Snap Creator Framework Snapcenter and 36 more
CVE-2016-1000027

spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

CVSS 3.1 · 9.8 Critical EPSS 33.2% KEV · Not listed
Vendors
Vmware
Products
Spring Framework
CVE-2026-47883

Spring Framework Open Redirect in UrlHandlerFilter

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-47889

Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-47888

Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-47886

Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-47887

Spring Framework Open Redirect in UrlFileNameViewController

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-47884

Spring Framework Improper Path Limitation in XsltView

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-47885

Spring Framework maxPartSize Ignored in PartEventHttpMessageReader

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework
CVE-2026-47890

Spring Framework Server Sent Event stream corruption while rendering fragments

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Framework Spring Framework