SF
Product
Spring Framework
On CISA KEVExploited in the wild
83
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 12High 26Medium 35Low 3
Watch
Add Spring Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22965 In wildKEV | 9.8 | Apr 1 | Spring Framework JDK 9+ Remote Code Execution Vulnerability Affected: before 5.2.20; 5.3.0 before 5.3.18 |
| CVE-2026-59313 | 9.8 | Aug 27 | Server Sent Event stream corruption in Spring MVC functional web framework Affected: 5.3.0 through 5.3.49; 6.0.0 through 6.0.30; 6.1.0 through 6.1.28; 6.2.0 through 6.2.19; 7.0.0 through 7.0.8 |
| CVE-2026-47892 | 9.8 | Aug 27 | Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints Affected: 5.2.5 before 5.2.26; 5.3.0 before 5.3.50; 6.0.0 before 6.0.31; 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-47891 | 9.8 | Aug 27 | Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder Affected: before 5.2.26; 5.3.0 before 5.3.50; 6.0.0 before 6.0.31; 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-47890 | 9.8 | Aug 27 | Spring Framework Server Sent Event stream corruption while rendering fragments Affected: 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-47884 | 9.8 | Aug 27 | Spring Framework Improper Path Limitation in XsltView Affected: before 5.2.26; 5.3.0 before 5.3.50; 6.0.0 before 6.0.31; 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-41855 | 9.8 | Jun 9 | Spring Framework Unsafe Deserialization via Jackson JMS Converters Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2016-1000027 | 9.8 | Jan 2 | Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data Affected: before 6.0.0 |
| CVE-2018-1275 | 9.8 | Apr 11 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a… Affected: 4.3.0 before 4.3.16; 5.0.0 before 5.0.5 |
| CVE-2018-1270 | 9.8 | Apr 6 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a… Affected: before 4.3.16; 5.0.0 before 5.0.5 |
| CVE-2015-5211 | 9.6 | May 25 | Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; +29 more |
| CVE-2026-59283 | 9.1 | Aug 27 | Spring Framework Safety Guard Bypass via SpEL Expression Compilation Affected: before 5.2.26; 5.3.0 before 5.3.50; 6.0.0 before 6.0.31; 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
Showing 12