What’s Vulnerable › Products
Spring Framework vulnerabilities
92 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 46 published in the last 12 months.
Check whether your Spring Framework version is affected
Exploited Spring Framework vulnerabilities
- CVE-2022-22965 — Spring Framework JDK 9+ Remote Code Execution Vulnerability
Latest Spring Framework vulnerabilities
- CVE-2026-59314 — Spring Framework response splitting in ContentDisposition (CVSS 3.7)
- CVE-2026-59313 — Server Sent Event stream corruption in Spring MVC functional web framework (CVSS 9.8)
- CVE-2026-59283 — Spring Framework Safety Guard Bypass via SpEL Expression Compilation (CVSS 9.1)
- CVE-2026-59282 — Spring Framework Denial of Service via Unbounded List Growth in Data Binding (CVSS 7.5)
- CVE-2026-59281 — Spring Framework Cross-site Scripting via EscapedErrors (CVSS 6.1)
- CVE-2026-59280 — Spring Framework Path Traversal via Backslash in SpringTemplateLoader (CVSS 4.3)
- CVE-2026-47893 — Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService (CVSS 7.5)
- CVE-2026-47892 — Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints (CVSS 9.8)
- CVE-2026-47891 — Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder (CVSS 9.8)
- CVE-2026-47890 — Spring Framework Server Sent Event stream corruption while rendering fragments (CVSS 9.8)
- CVE-2026-47889 — Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse (CVSS 7.5)
- CVE-2026-47888 — Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler (CVSS 7.5)
- CVE-2026-47887 — Spring Framework Open Redirect in UrlFileNameViewController (CVSS 6.1)
- CVE-2026-47886 — Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions (CVSS 7.5)
- CVE-2026-47885 — Spring Framework maxPartSize Ignored in PartEventHttpMessageReader (CVSS 7.5)
- CVE-2026-47884 — Spring Framework Improper Path Limitation in XsltView (CVSS 9.8)
- CVE-2026-47883 — Spring Framework Open Redirect in UrlHandlerFilter (CVSS 6.1)
- CVE-2026-41855 — Spring Framework Unsafe Deserialization via Jackson JMS Converters (CVSS 9.8)
- CVE-2026-41854 — Spring Framework Server-Side Request Forgery via UriComponentsBuilder (CVSS 6.5)
- CVE-2026-41853 — Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux (CVSS 5.3)
- CVE-2026-41852 — Spring Framework Arbitrary Method Invocation in SpEL Expressions (CVSS 5.3)
- CVE-2026-41851 — Spring Framework Denial of Service via Unbounded Cache in SpEL (CVSS 7.5)
- CVE-2026-41850 — Spring Framework Algorithmic Denial of Service via SpEL Expressions (CVSS 7.5)
- CVE-2026-41849 — Spring Framework Denial of Service via Integer Overflow in SpEL Expressions (CVSS 7.5)
- CVE-2026-41848 — Spring Framework Denial of Service via AntPathMatcher (CVSS 7.5)