SF
Product
Spring Framework
On CISA KEVExploited in the wild
83
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 12High 26Medium 35Low 3
Watch
Add Spring Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-41854 | 6.5 | Jun 9 | Spring Framework Server-Side Request Forgery via UriComponentsBuilder Affected: 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-22740 | 6.5 | Apr 29 | Spring Framework DoS with Multipart Temp Files in WebFlux Affected: 7.0.0 before 7.0.7; 6.2.0 before 6.2.18; 6.1.0 before 6.1.27; 5.3.0 before 5.3.48 |
| CVE-2023-20863 | 6.5 | Apr 13 | In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a… Affected: 5.2.0 before 5.2.24; 5.3.0 before 5.3.27; 6.0.0 before 6.0.8 |
| CVE-2023-20861 | 6.5 | Mar 23 | In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially… Affected: through 5.2.22; 5.3.0 through 5.3.25; 6.0.0 through 6.0.6 |
| CVE-2022-22971 | 6.5 | May 12 | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack… Affected: 5.2.0 through 5.2.21; 5.3.0 through 5.3.19 |
| CVE-2022-22950 | 6.5 | Apr 1 | n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of… Affected: before 5.2.20; 5.3.0 before 5.3.17 |
| CVE-2020-5421 | 6.5 | Sep 19 | RFD Protection Bypass via jsessionid Affected: before 4.3.29; 5.0.0 before 5.0.19; 5.1.0 before 5.1.18; 5.2.0 before 5.2.9 |
| CVE-2018-1257 | 6.5 | May 11 | Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a… Affected: before 4.3.17; 5.0.0 before 5.0.6 |
| CVE-2026-59281 | 6.1 | Aug 27 | Spring Framework Cross-site Scripting via EscapedErrors Affected: before 5.2.26; 5.3.0 before 5.3.50; 6.0.0 before 6.0.31; 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-47887 | 6.1 | Aug 27 | Spring Framework Open Redirect in UrlFileNameViewController Affected: before 5.2.26; 5.3.0 before 5.3.50; 6.0.0 before 6.0.31; 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-47883 | 6.1 | Aug 27 | Spring Framework Open Redirect in UrlHandlerFilter Affected: 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2026-41846 | 6.1 | Jun 9 | Spring Framework Cross-site Scripting via JSP Form Tags Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41845 | 6.1 | Jun 9 | Spring Framework Cross-site Scripting via JavaScriptUtils Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41844 | 6.1 | Jun 9 | Spring Framework Open Redirect in Spring MVC and WebFlux Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41843 | 5.9 | Jun 9 | Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41841 | 5.9 | Jun 9 | Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41840 | 5.9 | Jun 9 | Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-22737 | 5.9 | Mar 19 | Spring Framework Improper Path Limitation with Script View Templates Affected: before 5.3.47; 6.1.0 before 6.1.26; 6.2.0 before 6.2.17; 7.0.0 before 7.0.6 |
| CVE-2018-11039 | 5.9 | Jun 25 | Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any… Affected: before 4.3.18; 5.0.0 before 5.0.7 |
| CVE-2018-1271 | 5.9 | Apr 6 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources… Affected: 4.3.0 before 4.3.15; 5.0.0 before 5.0.5 |
| CVE-2015-3192 | 5.5 | Jul 12 | Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to… Affected: 3.2.1; 3.2.2; 3.2.3; 3.2.4; 3.2.5; 3.2.6; +13 more |
| CVE-2026-41853 | 5.3 | Jun 9 | Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41852 | 5.3 | Jun 9 | Spring Framework Arbitrary Method Invocation in SpEL Expressions Affected: 5.3.0 before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.18.1; 7.0.0 before 7.0.7.1 |
| CVE-2026-41847 | 5.3 | Jun 9 | Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL Affected: 5.3.0 before 5.3.49 |
| CVE-2026-22745 | 5.3 | Apr 29 | CVE-2026-22745 : Denial of service in static resource handling on Windows platforms Affected: 7.0.0 before 7.0.7; 6.2.0 before 6.2.18; 6.1.0 before 6.1.27; 5.3.0 before 5.3.48 |
| CVE-2024-38820 | 5.3 | Oct 18 | The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive Affected: 5.3.0 before 5.3.41; 6.0.0 before 6.0.25; 6.1.0 before 6.1.14 |
| CVE-2022-22970 | 5.3 | May 12 | In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data… Affected: through 5.2.21; 5.3.0 through 5.3.19 |
| CVE-2022-22968 | 5.3 | Apr 14 | In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a… Affected: before 5.2.0; 5.2.0 through 5.2.20; 5.3.0 through 5.3.18 |
| CVE-2020-5397 | 5.3 | Jan 17 | Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux… Affected: 5.2.0 before 5.2.3 |
| CVE-2018-1199 | 5.3 | Mar 16 | Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider… Affected: 4.3.0 before 4.3.14; 5.0.0 before 5.0.3 |
| CVE-2026-59280 | 4.3 | Aug 27 | Spring Framework Path Traversal via Backslash in SpringTemplateLoader Affected: before 5.2.26; 5.3.0 before 5.3.50; 6.0.0 before 6.0.31; 6.1.0 before 6.1.29; 6.2.0 before 6.2.20; 7.0.0 before 7.0.8.1 |
| CVE-2024-38808 | 4.3 | Aug 20 | In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression… Affected: 5.3.0 before 5.3.39 |
| CVE-2021-22060 | 4.3 | Jan 10 | In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of… Affected: 5.2.0 through 5.2.18; 5.3.0 through 5.3.13 |
| CVE-2021-22096 | 4.3 | Oct 28 | In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of… Affected: 5.2.0 through 5.2.17; 5.3.0 through 5.3.10 |
| CVE-2026-41839 | 4.2 | Jun 9 | Spring Framework Escalation via Session Fixation in WebFlux Affected: before 5.3.49; 6.1.0 before 6.1.28; 6.2.0 before 6.2.19; 7.0.0 before 7.0.8 |
Showing 35