Spring

Products

Exploited and recent CVEs

• CVE-2026-59324 High 8.2 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction 0.3%
• CVE-2026-59322 Medium 6.3 EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders 0.3%
• CVE-2026-59321 Medium 4.2 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check 0.2%
• CVE-2026-59320 Medium 6.5 In Spring AMQP the link credit never replenished on listener exception path 0.4%
• CVE-2026-59319 Medium 4.3 RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure 0.3%
• CVE-2026-59317 Medium 6.5 In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop 0.4%
• CVE-2026-59316 High 8.2 Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) 0.3%
• CVE-2026-59315 Medium 5.3 Spring Cloud Config Monitor Denial of Service 0.4%
• CVE-2026-59314 Low 3.7 Spring Framework response splitting in ContentDisposition 0.3%
• CVE-2026-59311 Medium 6.8 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation 0.4%
• CVE-2026-59306 Low 3.1 Potential for deserialization of untrusted types in Spring Cloud Stream 0.2%
• CVE-2026-59313 Critical 9.8 Server Sent Event stream corruption in Spring MVC functional web framework 0.6%
• CVE-2026-59307 High 8.0 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference 0.4%
• CVE-2026-59305 Low 3.1 Partition interceptor may be improperly added while sending message 0.2%
• CVE-2026-59304 Low 3.1 Improper caching of the original content type in Spring Cloud Stream Avro 0.2%
• CVE-2026-59303 Low 3.1 Dynamic destination cache size is not properly bound in Spring Cloud Stream 0.2%
• CVE-2026-59302 Low 3.1 Potential for logging sensitive data in Spring Cloud Stream 0.2%
• CVE-2026-59301 Low 3.1 Potential for logging sensitive data in Spring Cloud Function Azure 0.2%
• CVE-2026-59300 Low 3.1 Potential for logging sensitive data in Spring Cloud Function AWS 0.2%
• CVE-2026-59299 Low 3.1 Composition lookup can potentially poison base function in Spring Cloud Function 0.2%
• CVE-2026-59298 Low 3.1 Potential for improper filtering of HTTP headers in Spring Cloud Function 0.2%
• CVE-2026-59297 Low 3.1 Spring Cloud Function can incorrectly determine if URI is secure 0.1%
• CVE-2026-59294 Medium 5.9 Arbitrary File Write via Path Traversal in ResourceCacheService 0.4%
• CVE-2026-59293 Medium 6.6 SMB minimum protocol dialect defaults to SMB1 0.2%
• CVE-2026-59292 Low 3.2 World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions) 0.1%
• CVE-2026-59291 Low 2.0 Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function 0.2%
• CVE-2026-59289 High 7.5 Spring for GraphQL Denial of Service via pagination support 0.5%
• CVE-2026-59288 High 7.5 Spring for GraphQL Information Exposure in GraphiQL support 0.4%
• CVE-2026-59287 Medium 5.9 Spring for GraphQL WebSocket Client Denial of Service 0.4%
• CVE-2026-59286 High 8.1 Spring for GraphQL loads Untrusted Resources in GraphiQL support 0.3%