SF
Product
Spring Framework
37
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 13Medium 16Low 1
Watch
Add Spring Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59282 | 7.5 | Aug 27 | Spring Framework Denial of Service via Unbounded List Growth in Data Binding Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28; 6.0.0 through 6.0.30; 5.3.0 through 5.3.49; through 5.2.25.RELEASE |
| CVE-2026-47893 | 7.5 | Aug 27 | Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28; 6.0.0 through 6.0.30; 5.3.0 through 5.3.49; through 5.2.25.RELEASE |
| CVE-2026-47889 | 7.5 | Aug 27 | Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19 |
| CVE-2026-47888 | 7.5 | Aug 27 | Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28; 6.0.0 through 6.0.30; 5.3.0 through 5.3.49; 5.2.0.RELEASE through 5.2.25.RELEASE |
| CVE-2026-47886 | 7.5 | Aug 27 | Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28; 6.0.0 through 6.0.30; 5.3.0 through 5.3.49; through 5.2.25.RELEASE |
| CVE-2026-47885 | 7.5 | Aug 27 | Spring Framework maxPartSize Ignored in PartEventHttpMessageReader Affected: 7.0.0 through 7.0.8; 6.2.0 through 6.2.19; 6.1.0 through 6.1.28 |
| CVE-2026-41851 | 7.5 | Jun 9 | Spring Framework Denial of Service via Unbounded Cache in SpEL Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-41850 | 7.5 | Jun 9 | Spring Framework Algorithmic Denial of Service via SpEL Expressions Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-41849 | 7.5 | Jun 9 | Spring Framework Denial of Service via Integer Overflow in SpEL Expressions Affected: 5.3.0 before 5.3.49 |
| CVE-2026-41848 | 7.5 | Jun 9 | Spring Framework Denial of Service via AntPathMatcher Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-41842 | 7.5 | Jun 9 | Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2026-41838 | 7.5 | Jun 9 | Spring Framework Predictable Session ID in WebSocket Module Affected: 7.0.0 before 7.0.7.1; 6.2.0 before 6.2.18.1; 6.1.0 before 6.1.28; 5.3.0 before 5.3.49 |
| CVE-2020-5398 | 7.5 | Jan 16 | RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application Affected: 5.0 before v5.0.16.RELEASE; 5.1 before v5.1.13.RELEASE; 5.2 before v5.2.3.RELEASE |
Showing 13