SF
Product
Spring Framework
On CISA KEVExploited in the wild
83
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 12High 26Medium 35Low 3
Watch
Add Spring Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-41845 | 6.1 | Jun 9 | Spring Framework Cross-site Scripting via JavaScriptUtils Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41844 | 6.1 | Jun 9 | Spring Framework Open Redirect in Spring MVC and WebFlux Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41843 | 5.9 | Jun 9 | Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41841 | 5.9 | Jun 9 | Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41840 | 5.9 | Jun 9 | Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-22737 | 5.9 | Mar 19 | Spring Framework Improper Path Limitation with Script View Templates Affected: before 5.3.47; 6.1.0 before 6.1.26; 6.2.0 before 6.2.17; 7.0.0 before 7.0.6 |
| CVE-2018-11039 | 5.9 | Jun 25 | Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any… Affected: before 4.3.18; 5.0.0 before 5.0.7 |
| CVE-2018-1271 | 5.9 | Apr 6 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources… Affected: 4.3.0 before 4.3.15; 5.0.0 before 5.0.5 |
| CVE-2015-3192 | 5.5 | Jul 12 | Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to… Affected: 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; 3.2.6; +13 more |
| CVE-2026-41853 | 5.3 | Jun 9 | Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41852 | 5.3 | Jun 9 | Spring Framework Arbitrary Method Invocation in SpEL Expressions Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41847 | 5.3 | Jun 9 | Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL Affected: 5.3.0 before 5.3.49 |
| CVE-2026-22745 | 5.3 | Apr 29 | CVE-2026-22745 : Denial of service in static resource handling on Windows platforms Affected: 7.0.0 before 7.0.7; 6.2.0 before 6.2.18; 6.1.0 before 6.1.27; 5.3.0 before 5.3.48 |
| CVE-2024-38820 | 5.3 | Oct 18 | The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive Affected: 5.3.0 before 5.3.41; 6.0.0 before 6.0.25; 6.1.0 before 6.1.14 |
| CVE-2022-22970 | 5.3 | May 12 | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data… Affected: through 5.2.21; 5.3.0 through 5.3.19 |
| CVE-2022-22968 | 5.3 | Apr 14 | In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a… Affected: before 5.2.0; 5.2.0 through 5.2.20; 5.3.0 through 5.3.18 |
| CVE-2020-5397 | 5.3 | Jan 17 | Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux… Affected: 5.2.0 before 5.2.3 |
| CVE-2018-1199 | 5.3 | Mar 16 | Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider… Affected: 4.3.0 before 4.3.14; 5.0.0 before 5.0.3 |
| CVE-2026-59280 | 4.3 | Aug 27 | Spring Framework Path Traversal via Backslash in SpringTemplateLoader Affected: before 5.2.26; 5.3.0 before 5.3.50; 6.0.0 before 6.0.31; 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2024-38808 | 4.3 | Aug 20 | In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression… Affected: 5.3.0 before 5.3.39 |
| CVE-2021-22060 | 4.3 | Jan 10 | In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of… Affected: 5.2.0 through 5.2.18; 5.3.0 through 5.3.13 |
| CVE-2021-22096 | 4.3 | Oct 28 | In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of… Affected: 5.2.0 through 5.2.17; 5.3.0 through 5.3.10 |
| CVE-2026-41839 | 4.2 | Jun 9 | Spring Framework Escalation via Session Fixation in WebFlux Affected: before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.19; 7.0.0 before 7.0.8 |
| CVE-2026-59314 | 3.7 | Aug 27 | Spring Framework response splitting in ContentDisposition Affected: through 5.2.25; 5.3.0 through 5.3.49; 6.0.0 through 6.0.30; 6.1.0 through 6.1.28; 6.2.0 through 6.2.19; 7.0.0 through 7.0.8 |
| CVE-2026-22741 | 3.1 | Apr 29 | Static resource cache poisoning in Spring MVC and WebFlux Affected: 7.0.0 before 7.0.7; 6.2.0 before 6.2.18; 6.1.0 before 6.1.27; 5.3.0 before 5.3.48 |
| CVE-2026-22735 | 2.6 | Mar 19 | Server Sent Event stream corruption Affected: before 5.3.47; 6.1.0 before 6.1.26; 6.2.0 before 6.2.17; 7.0.0 before 7.0.6 |
| CVE-2015-0201 | – | Mar 10 | The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via… Affected: 4.1.1; 4.1.2; 4.1.3; 4.1.4 |
| CVE-2014-3625 | – | Nov 20 | Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read… Affected: 3.0.4 through 3.0.7 |
| CVE-2014-0054 | – | Apr 17 | The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote… Affected: through 3.2.7; 3.0.6; 3.0.7; 3.1.0; 3.1.1; 3.1.2; +9 more |
| CVE-2013-6429 | – | Jan 26 | The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote… Affected: 4.0.0; 4.0.0; 4.0.0 |
| CVE-2013-7315 | – | Jan 23 | The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows… Affected: through 3.2.3; 3.0.6; 3.0.7; 3.1.0; 3.1.1; 3.1.2; +7 more |
| CVE-2013-4152 | – | Jan 23 | The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers… Affected: through 3.2.3; 3.0.6; 3.0.7; 3.1.0; 3.1.1; 3.1.2; +6 more |
| CVE-2011-2894 | – | Oct 4 | Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which… Affected: 3.0.0 through 3.0.5 |