SF
Product
Spring Framework
On CISA KEVExploited in the wild
83
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 12High 26Medium 35Low 3
Watch
Add Spring Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1258 | 8.8 | May 11 | Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security Affected: 5.0.5 |
| CVE-2014-0225 | 8.8 | May 25 | When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the… Affected: 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; 3.0.6; +24 more |
| CVE-2024-22259 | 8.1 | Mar 16 | Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g Affected: before 5.3.33; 6.0.0 before 6.0.18; 6.1.0 before 6.1.5 |
| CVE-2021-22118 | 7.8 | May 27 | In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary… Affected: 5.2.0 before 5.2.15; 5.3.0 before 5.3.7 |
| CVE-2026-59282 | 7.5 | Aug 27 | Spring Framework Denial of Service via Unbounded List Growth in Data Binding Affected: before 5.2.26; 5.3.0 before 5.3.50; 6.0.0 before 6.0.31; 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-47893 | 7.5 | Aug 27 | Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService Affected: before 5.2.26; 5.3.0 before 5.3.50; 6.0.0 before 6.0.31; 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-47889 | 7.5 | Aug 27 | Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse Affected: 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-47888 | 7.5 | Aug 27 | Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler Affected: 5.2.0 before 5.2.26; 5.3.0 before 5.3.50; 6.0.0 before 6.0.31; 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-47886 | 7.5 | Aug 27 | Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions Affected: before 5.2.26; 5.3.0 before 5.3.50; 6.0.0 before 6.0.31; 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-47885 | 7.5 | Aug 27 | Spring Framework maxPartSize Ignored in PartEventHttpMessageReader Affected: 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-41851 | 7.5 | Jun 9 | Spring Framework Denial of Service via Unbounded Cache in SpEL Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41850 | 7.5 | Jun 9 | Spring Framework Algorithmic Denial of Service via SpEL Expressions Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41849 | 7.5 | Jun 9 | Spring Framework Denial of Service via Integer Overflow in SpEL Expressions Affected: 5.3.0 before 5.3.49 |
| CVE-2026-41848 | 7.5 | Jun 9 | Spring Framework Denial of Service via AntPathMatcher Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41842 | 7.5 | Jun 9 | Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41838 | 7.5 | Jun 9 | Spring Framework Predictable Session ID in WebSocket Module Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2024-22233 | 7.5 | Jan 22 | In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition Affected: 6.0.15; 6.1.2 |
| CVE-2023-34053 | 7.5 | Nov 28 | In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition Affected: 6.0.0 before 6.0.14 |
| CVE-2023-20860 | 7.5 | Mar 27 | Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern… Affected: 5.3.0 before 5.3.26; 6.0.0 before 6.0.7 |
| CVE-2020-5398 | 7.5 | Jan 16 | RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application Affected: 5.0.0 before 5.0.16; 5.1.0 before 5.1.13; 5.2.0 before 5.2.3 |
| CVE-2018-15756 | 7.5 | Oct 18 | DoS Attack via Range Requests Affected: 4.2.0 before 4.3.20; 5.0.0 before 5.0.10; 5.1.0 |
| CVE-2018-11040 | 7.5 | Jun 25 | Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON… Affected: before 4.3.18; 5.0.0 before 5.0.7 |
| CVE-2018-1272 | 7.5 | Apr 6 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests Affected: 4.3.0 before 4.3.15; 5.0 before 5.0.5 |
| CVE-2016-5007 | 7.5 | May 25 | Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers… Affected: 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; 3.2.6; +34 more |
| CVE-2016-9878 | 7.5 | Dec 29 | An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5 Affected: 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; 3.2.6; +23 more |
| CVE-2018-15801 | 7.4 | Dec 19 | Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation Affected: 5.1.0 before 5.1.2 |
Showing 26