SF
Product
Spring Framework
37
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 13Medium 16Low 1
Watch
Add Spring Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59313 | 9.8 | Aug 27 | Server Sent Event stream corruption in Spring MVC functional web framework Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28; 6.0.0 through 6.0.30; 5.3.0 through 5.3.49 |
| CVE-2026-47892 | 9.8 | Aug 27 | Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28; 6.0.0 through 6.0.30; 5.3.0 through 5.3.49; 5.2.5.RELEASE through 5.2.25.RELEASE |
| CVE-2026-47891 | 9.8 | Aug 27 | Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28; 6.0.0 through 6.0.30; 5.3.0 through 5.3.49; through 5.2.25.RELEASE |
| CVE-2026-47890 | 9.8 | Aug 27 | Spring Framework Server Sent Event stream corruption while rendering fragments Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19 |
| CVE-2026-47884 | 9.8 | Aug 27 | Spring Framework Improper Path Limitation in XsltView Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28; 6.0.0 through 6.0.30; 5.3.0 through 5.3.49; through 5.2.25.RELEASE |
| CVE-2026-41855 | 9.8 | Jun 9 | Spring Framework Unsafe Deserialization via Jackson JMS Converters Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-59283 | 9.1 | Aug 27 | Spring Framework Safety Guard Bypass via SpEL Expression Compilation Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28; 6.0.0 through 6.0.30; 5.3.0 through 5.3.49; through 5.2.25.RELEASE |
Showing 7