Spring
Monthly
Directory traversal in Handlebars.java before 4.5.5 lets unauthenticated remote attackers read arbitrary files outside the configured template base directory in Spring MVC applications that use the handlebars-springmvc integration. The flaw specifically affects handlebars-springmvc 4.5.3 and 4.5.4, where the path-containment check added for CVE-2026-63490 validates template locations as raw percent-encoded strings while the template file is ultimately opened through a URL handler that percent-decodes the path, so a request-derived view name containing %2e%2e/ slips past both the view-resolver and loader-side checks. Exploitation is not confirmed in the wild and no public exploit code has been identified at time of analysis, but it requires two non-default conditions to hold simultaneously: a file: template location prefix and a Handlebars view name derived from untrusted request input, which keeps real-world priority moderate despite the 7.5 CVSS score. Impact is limited to confidentiality (arbitrary file read); integrity and availability are unaffected.
Spring Integration's reactive message pipeline leaks reply routing and security headers across concurrent users when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering operator that emits raw payloads, causing one user's replyChannel, correlationId, and security or tenant headers to be applied to another concurrent user's response. Affected versions span the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines across the core Spring Integration library, as confirmed by VMware via the spring.io security advisory. The CVSS 8.2 score reflects network exploitability with no authentication required and high confidentiality impact; no public exploit has been identified at time of analysis.
Stored cross-site scripting in Spring Authorization Server's DefaultConsentPage allows network-accessible, unauthenticated attackers to inject arbitrary JavaScript into the OAuth2 consent screen presented to legitimate users. Affected versions span 1.4.0-1.4.11 and 1.5.0-1.5.8; the attack payload is embedded in a crafted OAuth2 authorization request, persisted server-side, and executed in the victim's browser when they view the consent dialog. No public exploit has been identified at time of analysis, but the low-complexity injection mechanism combined with a CVSS 8.2 base score and high confidentiality impact makes this an urgent remediation target for any deployment relying on the default consent page.
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across Spring Framework 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19 and 7.0.0-7.0.8, where unneutralized CRLF sequences (CWE-93) let an attacker inject into or corrupt the event stream. Reported by VMware/Spring and tagged as Information Disclosure, the flaw can break stream framing and potentially leak or splice data across SSE responses. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), but the vendor-assigned CVSS of 9.8 (all-High impact) sits in tension with the information-disclosure framing and warrants scrutiny.
JdbcMessageStore deserialization allowlist protection in Spring Integration silently fails when the store is configured as a Spring-managed bean, rendering the security control entirely ineffective. Operators who call addAllowedPatterns() to restrict which Java classes can be deserialized from the JDBC message store receive no actual protection - any class remains deserializable despite the configured allowlist - leaving applications exposed to unsafe Java deserialization attacks while operators believe they have hardened the component. Affected across Spring Integration 6.4.x through 7.1.0; no public exploit identified at time of analysis.
Spring for GraphQL's Spring Data pagination integration blindly forwards client-supplied Connection field arguments to the underlying repository without enforcing resource limits, enabling an unauthenticated remote attacker to exhaust JVM heap memory or impose sustained load on the backing datastore via crafted GraphQL pagination queries. Three release branches are affected: 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9, as confirmed by EUVD-2026-67178 and the VMware/Spring security advisory. No public exploit has been identified and the EPSS probability is very low (0.16%, 5th percentile), though the unauthenticated, network-accessible attack path makes any openly exposed endpoint a viable denial-of-service target.
Cross-origin data exfiltration in Spring for GraphQL exposes confidential application data when a victim browses a crafted URL pointing to the bundled GraphiQL interface. The GraphiQL IDE, intended for development use, can be weaponized to direct the victim's authenticated browser session to send GraphQL queries whose responses are leaked to an attacker-controlled origin. All major release lines from 1.0.0 through 2.0.4 are affected; no public exploit has been identified and the EPSS score sits at the 4th percentile, but the high confidentiality impact (C:H) and scope change make this notable for any deployment with GraphiQL exposed beyond trusted networks.
Spring for GraphQL's bundled GraphiQL developer IDE loads third-party JavaScript libraries from a public CDN without Subresource Integrity (SRI) verification, allowing any attacker capable of tampering with CDN responses to inject and execute arbitrary JavaScript in any browser that loads the GraphiQL page. All four maintained release lines are affected (1.0.x through 2.0.4), as confirmed by the VMware/Spring security advisory and EUVD-2026-67175. No public exploit code has been identified at time of analysis, and EPSS at 0.11% (2nd percentile) reflects currently minimal exploitation activity.
Unsafe deserialization in Spring for GraphQL 2.0.0-2.0.4 exposes Java applications to potential remote code execution when processing paginated GraphQL queries. The flaw, classified as CWE-502, allows network-accessible, unauthenticated attackers to supply crafted payloads through pagination parameters that are deserialized server-side without adequate type safety. CVSS 8.1 with AC:H reflects that exploitation hinges on the presence of a suitable Java gadget chain on the application classpath; EPSS of 0.44% (36th percentile) and no KEV listing indicate no widespread exploitation has been observed at time of analysis.
Unrestricted property key injection via Spring Cloud Commons' writable /actuator/env endpoint allows authenticated administrators to POST arbitrary environment properties with no allow-list enforcement, affecting all currently maintained release lines (3.1.10 and earlier through 5.0.2). With CVSS PR:H and a scope change (S:C), exploitation requires admin-level access to the actuator endpoint but can cascade integrity impacts across the entire Spring application context. No public exploit has been identified at time of analysis, and exploitation is gated on a non-default configuration requiring deliberate enablement of write access to the actuator endpoint.
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input escape the restricted SimpleEvaluationContext sandbox when the SpEL bytecode compiler is active, affecting Spring Framework 5.2.x through 7.0.8 across the 5.3, 6.0, 6.1, 6.2 and 7.0 lines. Because SimpleEvaluationContext is the API applications are told to use to safely evaluate untrusted expressions, this bypass can escalate a data-binding-only context into broader method invocation with high integrity and availability impact (CVSS 9.1, CWE-913). There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), indicating no observed mass exploitation yet.
Denial of Service exposure in Spring Framework's data binding infrastructure allows unauthenticated remote attackers to exhaust application resources by submitting crafted property path expressions to any endpoint that binds user-supplied paths onto Java target objects. Affected versions span the entire actively maintained Spring Framework lineage - 5.2.x through 7.0.x - making the aggregate exposure footprint very large. No public exploit is referenced and EPSS sits at 0.15% (4th percentile), indicating low current exploitation activity despite the high CVSS score of 7.5.
Denial of service in Spring Reactor Core exposes reactive Java applications to an infinite-loop condition (CWE-835) when the Flux.bufferTimeout operator is used with fairBackpressure enabled. Affected branches span 3.7.x through 3.7.19 and 3.8.0 through 3.8.6, meaning applications on both supported and legacy release trains are vulnerable. No active exploitation has been identified (SSVC: none), and EPSS probability sits at 0.22%, but the network-accessible nature of reactive endpoints makes this a realistic denial-of-service vector for exposed services using the specific configuration.
Predictable ONNX model cache path creation in Spring AI enables a local attacker on a shared multi-user host to pre-create the cache location and substitute a malicious ONNX model before the application writes its legitimate copy. Affected versions span Spring AI 1.0.0-1.0.9, 1.1.0-1.1.8, and 2.0.0. No public exploit code or CISA KEV listing has been identified at time of analysis; critically, the supplied CVSS vector (AV:N/PR:N) is materially inconsistent with the description's local-access requirement, meaning the raw score of 7.5 substantially overstates the realistic attack surface.
Denial of service in Spring AI's PDF document ingestion crashes the processing thread when parsing a crafted PDF with a deeply nested or cyclic table of contents structure. Affected versions span the 1.0.x and 1.1.x release lines as well as the 2.0.0 release. An unauthenticated remote attacker who can supply a malicious PDF to an application's ingestion pipeline can trigger a StackOverflowError, halting document processing availability with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
WebAuthn user verification bypass in Spring Security exposes applications to authentication circumvention when a distributed HTTP session store is in use. Affected versions span Spring Security 6.4.x through 7.1.0, meaning a broad range of enterprise Spring Boot applications leveraging passwordless/FIDO2 authentication are at risk. An unauthenticated remote attacker with the ability to manipulate the WebAuthn ceremony flow can bypass the user verification check - potentially authenticating as a legitimate user - with no public exploit identified at time of analysis.
Missing authentication on Spring Cloud Config Server's /monitor endpoint lets remote attackers submit unvalidated webhook requests, forcing configuration-refresh events without any credentials. It affects Spring Cloud Config 3.x through 3.1.14, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4, and is exploitable only when the spring-cloud-config-monitor component is enabled. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile) and CISA SSVC rates exploitation as none and technical impact as only partial, tempering the vendor's 9.8 rating.
Time-of-check-time-of-use (TOCTOU) race condition in Spring Cloud Config Server's SVN backend allows unauthenticated network attackers to manipulate the basedir path between validation and use, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Affected are all branches of Spring Cloud Config through 5.0.4, 4.3.4, 4.2.8, and 3.1.14 and earlier, covering a broad range of enterprise Spring microservices deployments. No public exploit code has been identified and no active exploitation is confirmed; however, the vendor (VMware/Spring) has released patches across all affected branches.
DPoP proof replay attack in Spring Security's DPoPProofJwtDecoderFactory allows unauthenticated network attackers to bypass token binding protections by evicting cached JWT ID entries through request flooding, then replaying captured valid DPoP proofs to impersonate legitimate users. Affected versions span Spring Security 6.5.0-6.5.11, 7.0.0-7.0.6, and 7.1.0, impacting any Java application using Spring Security's DPoP-based OAuth 2.0 validation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H ratings reflect full token-holder impersonation upon successful exploitation.
Predictable shared-secret generation in Spring Tools for Eclipse (5.2.0 and earlier) weakens the authentication protecting Spring Boot DevTools remote-restart uploads to remotely deployed targets such as Docker containers or Cloud Foundry apps. Because the secret is derived from a non-cryptographic PRNG rather than a secure random source, an attacker able to reach the deployed application's DevTools remote endpoint may predict the secret, authenticate restart uploads, and push arbitrary code, yielding remote code execution (CVSS 8.3, scope-changed). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Network exposure of Docker container control ports in Spring Tools for Eclipse (versions 5.2.0 and earlier) occurs because the Boot Dashboard Docker integration binds these ports to 0.0.0.0 (all interfaces) instead of loopback. Any attacker on the same network segment as a developer running the integration can reach the container control interface without authentication, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the flaw is trivially triggered once a developer starts the affected feature.
Remote code execution in the Spring Tools IDE extensions (Spring Tools for Eclipse ≤5.2.0 and for VSCode/Cursor/Theia ≤2.2.0) occurs when a developer launches a Spring Boot application with the 'live information' mode enabled, which exposes an unprotected JMX endpoint that an adjacent-network attacker can abuse to execute arbitrary code on the developer's host. The flaw carries a CVSS 8.0 (High) rating and requires the developer to actively start the app in live mode (UI:R). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Origin validation failure in Spring Cloud Gateway (WebMVC and WebFlux Server variants) allows remote attackers to spoof client identity by injecting X-Forwarded-For and Forwarded headers that the gateway then forwards from untrusted proxies in certain configuration scenarios. The flaw, tracked as CVE-2026-47825 with a CVSS 3.1 base score of 8.6 (Scope:Changed, Integrity:High), affects Spring Cloud Gateway 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x. No public exploit identified at time of analysis, but the trust-boundary nature of the issue makes it an attractive target for downstream authentication and access-control bypass.
Denial-of-service in Spring Cloud Sleuth 3.1.0 through 3.1.13 allows remote unauthenticated attackers to exhaust application availability by sending specially crafted calls processed by the spring-cloud-sleuth-instrumentation library when Spring TX (transaction) instrumentation is enabled. The flaw is network-reachable with low attack complexity and no user interaction (CVSS 7.5, AV:N/AC:L/PR:N), but there is no public exploit identified at time of analysis and no CISA KEV listing. Impact is limited to availability - no confidentiality or integrity compromise is possible.
NoSQL/query injection in Spring AI Vector Stores (1.0.0-1.0.8 and 1.1.0-1.1.7) allows remote unauthenticated attackers to inject special characters into vector-store inputs and force execution of arbitrary queries against Elasticsearch, OpenSearch, and GemFire VectorDB backends. The flaw resides in the spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store components, enabling information disclosure and limited integrity/availability impact against any application embedding Spring AI's vector-store abstraction. No public exploit identified at time of analysis, but the CVSS 8.6 (scope unchanged here, network vector, no privileges) makes this a high-priority patch for any Spring AI deployment ingesting untrusted text.
Authorization bypass in Spring for GraphQL (versions 1.0.0-1.0.6, 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3) allows remote attackers to invoke @Controller data fetcher methods whose security annotations are declared on parent classes or interfaces, because the framework's annotation detection does not consistently resolve annotations across type hierarchies. The flaw is rated CVSS 7.5 (confidentiality-only impact) and no public exploit identified at time of analysis, but the network-reachable, no-privilege CVSS vector makes any affected GraphQL endpoint a meaningful exposure.
Cross-Site WebSocket Hijacking in Spring for GraphQL allows remote attackers to execute arbitrary GraphQL operations under an authenticated victim's identity when the application has enabled the GraphQL WebSocket transport. The flaw stems from missing origin validation on WebSocket handshakes (CWE-346), affecting Spring for GraphQL 1.0.x, 1.3.x, 1.4.x, and 2.0.x branches up to 2.0.3. No public exploit identified at time of analysis, but the high CVSS (8.1) and reliance only on a single victim click make this a meaningful risk for any deployment exposing the WebSocket endpoint.
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated attackers to trigger unsafe deserialization by sending crafted paginated GraphQL queries against Connection-type fields. Exploitation requires that the application expose a paginated (Connection) field and that the classpath contains gadget classes leveraged during deserialization. No public exploit identified at time of analysis; EPSS sits at 0.34% (57th percentile) and the issue is not in CISA KEV, but a vendor patch is available.
Server-Side Request Forgery in Spring Web Services (versions 3.1.0-3.1.8, 4.0.0-4.0.18, 4.1.0-4.1.3, and 5.0.0-5.0.1) allows remote unauthenticated attackers to coerce the server into initiating outbound HTTP connections to attacker-controlled or internal destinations by abusing WS-Addressing ReplyTo/FaultTo headers. The flaw stems from WebServiceMessageSender instances dispatching to destinations taken directly from SOAP request headers without validating that the targets are safe. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
XML External Entity (XXE) exposure in Spring Web Services' Jaxp13XPathTemplate allows remote attackers to abuse XPath evaluation over StreamSource and SAXSource inputs because the underlying parser falls back to the JDK's default DocumentBuilderFactory rather than Spring's hardened configuration. Affected versions span the 3.1.x, 4.0.x, 4.1.x and 5.0.x release lines, and while no public exploit was identified at time of analysis, the CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N) indicates that any service that feeds untrusted XML through this template can be reached by unauthenticated remote attackers. The flaw was reported by VMware/Spring and is tracked in the official Spring security advisory.
Insecure default initialization in Spring Web Services' Wss4jSecurityInterceptor disables WSS4J BSP (WS-I Basic Security Profile) enforcement on inbound RequestData, allowing remote attackers to submit SOAP messages that violate BSP-mandated WS-Security rules. Affected versions span 3.1.0-3.1.8, 4.0.0-4.0.18, 4.1.0-4.1.3, and 5.0.0-5.0.1, with no public exploit identified at time of analysis. The CVSS 8.2 score reflects high integrity impact because protocol-level cryptographic checks expected by downstream consumers are silently weakened.
Path traversal in Spring Integration's FTP/SFTP/SMB inbound adapters allows a malicious or compromised remote file server to write attacker-controlled files outside the configured local directory on any client polling it, affecting versions 5.5.0-5.5.20, 6.3.0-6.3.14, 6.4.0-6.4.11, 6.5.0-6.5.8, and 7.0.0-7.0.4. The flaw inverts the usual trust model - the file-transfer client trusts the server's filename, enabling overwrite of arbitrary host files such as configuration, cron, or application JARs, which can escalate to code execution. No public exploit identified at time of analysis, but the issue is straightforward to weaponize once a hostile server endpoint is reachable.
Memory exhaustion in Spring HATEOAS versions 1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, and 3.0.0-3.0.3 allows remote unauthenticated attackers to cause denial of service by sending requests with attacker-controlled link relation strings that accumulate indefinitely in an unbounded static cache of StringLinkRelation instances. With a CVSS 7.5 (high availability impact) and no public exploit identified at time of analysis, the issue is straightforward to trigger against any internet-facing Spring HATEOAS endpoint that derives link relations from request data. Not listed in CISA KEV.
Denial-of-service via improper access control in Spring HATEOAS affects versions 1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, and 3.0.0-3.0.3, where the internal PropertyUtils.createObjectFromProperties method performs reflection-based bean property binding while ignoring Jackson access-control annotations (@JsonIgnore, @JsonProperty access modes). Remote unauthenticated attackers sending crafted Collection+JSON or UBER media type payloads can bind to properties the developer explicitly marked as inbound-restricted, causing high-availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJsonMessageConverter) lets an attacker who controls JMS message content instantiate arbitrary classes, enabling gadget-chain attacks that can escalate to unauthorized actions or remote code execution. It affects Spring Framework 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7 when applications consume messages from an untrusted JMS source. There is no public exploit identified at time of analysis, and despite a 9.8 CVSS the EPSS probability is only 0.04% and CISA SSVC rates exploitation as 'none'.
Denial of service in VMware's Spring Framework (versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7) lets remote attackers exhaust memory in applications that evaluate user-supplied Spring Expression Language (SpEL) expressions, where crafted expressions trigger unbounded internal cache growth. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N), and the impact is availability-only (C:N/I:N/A:H). There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.01%, 2nd percentile), though CISA's SSVC framework flags the issue as automatable.
Algorithmic denial of service in Spring Framework SpEL evaluation allows remote unauthenticated attackers to exhaust CPU/memory resources by submitting specially crafted Spring Expression Language expressions, degrading or crashing affected applications. Impacts Spring Framework 5.3.x through 7.0.x in any application that evaluates user-supplied SpEL. No public exploit identified at time of analysis, and the CVSS 7.5 score reflects high availability impact with no confidentiality or integrity compromise.
Denial of service in Spring Framework 5.3.0 through 5.3.48 allows remote unauthenticated attackers to exhaust server resources by submitting crafted Spring Expression Language (SpEL) expressions that trigger an integer overflow during evaluation. The CVSS 7.5 score reflects high availability impact with no confidentiality or integrity loss, and no public exploit identified at time of analysis. Applications that evaluate untrusted SpEL input are at greatest risk.
Denial of service in Spring Framework's AntPathMatcher allows remote unauthenticated attackers to exhaust CPU resources via Regular Expression Denial of Service (ReDoS) when attacker-controlled patterns are passed to match(), matchStart(), or extractUriTemplateVariables(). Affects Spring Framework 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7. No public exploit identified at time of analysis, EPSS is very low (0.01%, 2nd percentile), and SSVC indicates no observed exploitation.
Denial of service in Spring Framework's Spring MVC and WebFlux static resource resolution allows remote unauthenticated attackers to exhaust application resources, affecting versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7. The CVSS 7.5 score reflects high-impact availability damage over the network with no privileges or user interaction, and at time of analysis no public exploit identified at time of analysis. The flaw was reported by VMware (Spring's maintainer) and is tracked under the official Spring Security advisory.
Predictable WebSocket session IDs in Spring Framework's spring-websocket module allow remote attackers to guess or forge session identifiers and, when paired with weak authorization rules, hijack or interact with other users' WebSocket sessions. The flaw affects Spring Framework 5.3.x, 6.1.x, 6.2.x, and 7.0.x prior to patched releases; no public exploit identified at time of analysis and EPSS is very low (0.03%).
Authentication bypass in Spring LDAP's DirContextAuthenticationStrategy allows remote unauthenticated attackers to succeed at LDAP bind operations by supplying any non-empty username paired with an empty or null password, due to the framework failing to reject such anonymous-equivalent bind requests. Affected releases span Spring LDAP 2.4.0-2.4.4, 3.2.0-3.2.17, 3.3.0-3.3.7, and 4.0.0-4.0.3, putting Java applications that delegate authentication to these libraries at risk of impersonating arbitrary users. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial-of-service in Micrometer (micrometer-core, micrometer-jetty11, and micrometer-jetty12) allows remote unauthenticated attackers to exhaust resources by sending specially crafted HTTP requests against applications that expose Micrometer-instrumented endpoints. The flaw affects a wide swath of supported 1.9.x through 1.16.x release lines and carries a CVSS 7.5 (availability-only) impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial-of-service in Micrometer (Spring observability library) versions 1.15.0-1.15.11 and 1.16.0-1.16.5 allows remote unauthenticated attackers to exhaust resources via specially crafted gRPC requests. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) reflecting availability-only impact, the issue is reachable over the network without credentials, though no public exploit identified at time of analysis. Applications embedding Micrometer's gRPC instrumentation are most exposed.
Filter-expression injection in Spring AI's MilvusVectorStore allows remote unauthenticated attackers to manipulate vector database queries by injecting malicious filter expressions through unsanitized document IDs. Affects Spring AI 1.0.0-1.0.6 and 1.1.0-1.1.5. VMware has released patches in versions 1.0.7 and 1.1.6. CVSS 8.6 (High) with network attack vector and no privileges required. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
Remote unauthenticated attackers can access Google Secrets Manager credentials from unintended GCP projects via crafted requests to Spring Cloud Config servers using Google Secrets Manager as a backend. VMware confirmed this high-severity information disclosure vulnerability (CVSS 7.5) affecting all 3.1.x through 5.0.x versions. No CISA KEV listing or public exploit code identified at time of analysis, but the network-accessible attack vector with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N) indicates straightforward exploitation once attackers identify vulnerable Spring Cloud Config deployments with Google Secrets Manager integration.
Time-of-check-time-of-use (TOCTOU) race condition in Spring Cloud Config Server's Git repository cloning mechanism allows local privileged attackers with high-privilege system access to potentially read or modify configuration data intended for other applications. Exploitation requires timing manipulation of the basedir filesystem path between validation and use, enabling symlink attacks or directory substitution. CVSS 7.2 reflects high attack complexity (AC:H) and privileged local access (AV:L/PR:H) requirements, but scope change (S:C) indicates impact beyond the vulnerable component. EPSS data not available; no public exploit identified at time of analysis.
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files from the file system using specially crafted URLs. Affects Spring Cloud Config versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2, with patches available across all branches. The vulnerability achieves CVSS 9.1 (Critical) due to remote exploitation without authentication (AV:N/AC:L/PR:N/UI:N) and high confidentiality/integrity impact, though EPSS and KEV data are not available to confirm active exploitation status. VMware/Spring has released fixes for all affected versions.
Filter expression injection in Spring AI 1.0.0-1.0.5 and 1.1.0-1.1.4 allows remote unauthenticated attackers to manipulate vector store queries through unescaped keys and values in FilterExpressionConverter implementations. The vulnerability enables query language injection across multiple vector database backends, potentially exposing sensitive data (CVSS:C:H) and modifying query results (CVSS:I:L). VMware has released patches in versions 1.0.6 and 1.1.5. No active exploitation confirmed (not in CISA KEV), but the network-accessible attack vector (AV:N/AC:L/PR:N) and code injection classification (CWE-94) indicate significant risk for applications processing untrusted filter expressions.
Timing attack against Spring Boot DevTools remote secret comparison allows adjacent network attackers to recover the shared secret and achieve remote code execution by uploading malicious classes. Affects Spring Boot 2.7.x through 4.0.x when DevTools remote feature is enabled. Attacker must be on same network segment (AV:A) and overcome high attack complexity (timing-based cryptographic weakness), but requires no authentication or user interaction. CVSS 7.5 severity reflects adjacent vector limitation; real-world risk depends heavily on whether DevTools remote restart is enabled in production (not recommended practice) and network segmentation. No confirmed active exploitation (not in CISA KEV). Vendor-released patches available across all affected branches.
Spring Boot's RabbitMQ auto-configuration omits TLS hostname verification when an SSL bundle is configured, enabling a man-in-the-middle attack on the message broker connection. Affected are Spring Boot 4.0.0-4.0.5 and 3.5.0-3.5.13; fixed in 4.0.6 and 3.5.14 respectively per the vendor advisory at spring.io. No active exploitation has been confirmed - CISA KEV status is absent, EPSS is 0.01% (3rd percentile), and SSVC classifies exploitation as none - making this a medium-priority patch for deployments that use SSL bundles with RabbitMQ.
Authorization bypass in Spring Security 7.0.0-7.0.4 allows unauthenticated remote attackers to circumvent access controls when applications use servlet-path-based intercept-url configurations. The framework fails to include the servlet path when computing pattern matches for authorization rules, causing protected endpoints to become accessible without proper authorization checks. No public exploit code identified at time of analysis, but the straightforward bypass condition (misconfigured servlet-path directives) and network attack vector (CVSS AV:N/AC:L/PR:N) make this readily exploitable in affected deployments.
Path matching bypass in Spring Security 7.0.0-7.0.4 allows unauthenticated remote attackers to evade authentication, authorization, and other security controls when applications use securityMatchers(String) with a PathPatternRequestMatcher.Builder bean to prepend servlet paths. Improper matcher configuration causes filter chains to silently fail, leaving protected endpoints exposed without intended security controls. No active exploitation confirmed, but CVSS 7.5 with network attack vector (AV:N/AC:L/PR:N) indicates readily exploitable if applications use the specific configuration pattern. VMware-reported vulnerability requires immediate patching for affected Spring Security 7.x deployments.
Authentication bypass via user impersonation affects Spring Security 7.0.0 through 7.0.4, where the SubjectX500PrincipalExtractor mishandles malformed CN values in X.509 client certificates and extracts the wrong username. Authenticated attackers presenting a carefully crafted certificate can be authenticated as a different (potentially higher-privileged) user. No public exploit identified at time of analysis; EPSS is very low (0.02%) and CISA SSVC marks exploitation as none.
Spring AI Redis vector store implementations expose sensitive data through unescaped TAG field filter injection in versions 1.0.0-1.0.4 and 1.1.0-1.1.3. Unauthenticated remote attackers can craft malicious filter expressions that bypass query boundaries in RediSearch TAG blocks, allowing extraction of unauthorized information from the vector database (CVSS 7.5 High, C:H). No public exploit identified at time of analysis, though the vulnerability is straightforward to exploit given its low attack complexity (AC:L).
Cypher injection in Spring AI Neo4j vector store (versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3) allows unauthenticated remote attackers to access confidential data stored in Neo4j databases. The vulnerability exists in Neo4jVectorFilterExpressionConverter where user-controlled filter expression keys are embedded into Cypher property accessors without proper backtick escaping, enabling attackers to break out of the intended property context and execute arbitrary Cypher queries. CVSS score of 7.5 reflects high confidentiality impact with network accessibility and low attack complexity, though no public exploit has been identified at time of analysis.
Server-Side Request Forgery in Spring AI Bedrock Converse module enables unauthenticated remote attackers to force the application server to issue HTTP requests to arbitrary internal or external destinations by supplying malicious media URLs in multimodal messages. Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 are affected. The vulnerability carries a CVSS score of 8.6 with high confidentiality impact and changed scope, indicating potential access to internal network resources. No public exploit identified at time of analysis.
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Spring Expression Language (SpEL) injection in the SimpleVectorStore component when user-supplied input is incorporated into filter expression keys. This critical vulnerability (CVSS 9.8) enables attackers to execute arbitrary code without authentication on applications using SimpleVectorStore with untrusted filter input. No public exploit identified at time of analysis, though the attack complexity is low and requires no user interaction according to the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing unauthenticated remote attackers to access arbitrary files outside configured search directories by manipulating the profile parameter in requests. This affects Spring Cloud versions 3.1.X before 3.1.13, 4.1.X before 4.1.9, 4.2.X before 4.2.3, 4.3.X before 4.3.2, and 5.0.X before 5.0.2. With a CVSS score of 8.6 indicating high confidentiality impact with some integrity and availability impact, and network-based attack vector requiring no authentication, this represents a significant information disclosure risk for exposed Config Server instances.
Spring Security fails to properly write HTTP response headers in servlet applications across multiple versions (5.7.0-5.7.21, 5.8.0-5.8.23, 6.3.0-6.3.14, 6.4.0-6.4.14, 6.5.0-6.5.8, 7.0.0-7.0.3), allowing attackers to bypass security controls that rely on these headers such as HSTS, X-Frame-Options, or CSP policies. This header omission could enable various attacks including clickjacking, man-in-the-middle attacks, or other exploits depending on which protections are intended. No patch is currently available for this critical vulnerability.
Spring Boot Actuator endpoints can be bypassed for authentication when application endpoints are configured under Health Group paths in versions 4.0 before 4.0.3, 3.5 before 3.5.11, and 3.4 before 3.4.15. An unauthenticated attacker can exploit this path-based misconfiguration to gain unauthorized access to protected resources with high confidence in authentication bypass and partial information disclosure. No patch is currently available.
Unsafe header deserialization in Spring Integration's EmbeddedHeadersJsonMessageMapper exposes applications to header injection across all active release trains (5.5.x through 7.1.0). The decodeNativeFormat method constructs GenericMessage objects with MutableMessageHeaders populated directly from attacker-controlled JSON-deserialized header maps, bypassing sanitization by default in the constructor. Low-privileged network attackers who can submit crafted byte payloads to an affected consumer channel can manipulate message headers, yielding partial confidentiality, integrity, and availability impacts. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV.
Concurrent message processing in Spring Integration's script-backed channels causes shared ScriptEngine state corruption when using JSR-223 engines that declare THREADING=null, such as the Kotlin KTS engine. Affected Spring Integration versions from 5.5.21 and earlier through 7.1.0 are susceptible to cross-message data leakage, where one message's payload or header bindings can bleed into another message's script evaluation context under concurrent load. No public exploit has been identified at time of analysis, and the CVSS 4.2 Medium rating reflects the high attack complexity imposed by the required race condition, though the information disclosure and partial integrity impact are real concerns in multi-tenant or high-throughput deployments.
Link credit exhaustion in Spring AMQP 4.1.0 silently stalls AMQP listener containers when a container-level ErrorHandler is active. Each message delivery whose processing throws an exception permanently consumes one link credit without returning it to the broker; once the pool reaches zero (after the default 100 credits), the broker halts delivery while isRunning() continues to report true, masking the outage from standard health checks. No active exploitation has been confirmed (no CISA KEV listing, no public POC), but this is a realistic denial-of-service condition for any Spring-based messaging consumer running the affected version with an ErrorHandler configured.
RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.
Denial-of-service in Spring for Apache Kafka's `DeadLetterPublishingRecovererFactory` exposes consumer JVMs across all supported branches (2.8.x through 4.1.0) to crash or hang when processing messages with a crafted `retry_topic-original-timestamp` header. An authenticated Kafka producer can inject a ConsumerRecord carrying an oversized or malformed header byte array, which is passed without any length or format validation directly to Java's `BigInteger(byte[])` constructor, triggering heap memory exhaustion or an unhandled exception that disrupts message consumption. No public exploit code has been identified and the CVE does not appear in CISA KEV at time of analysis, but low attack complexity combined with broad version coverage makes this a credible availability threat for any Spring Kafka deployment using retry or dead-letter queue features.
Denial of Service in Spring Cloud Config's Monitor component allows unauthenticated remote attackers to crash or degrade the configuration server by submitting malicious payloads to the webhook endpoint. Affected versions span the 3.x, 4.x, and 5.x release lines, covering a broad installed base of Spring Boot microservice environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated network-accessible attack surface (PR:N, AV:N, AC:L) means exploitation requires minimal capability.
HTTP response splitting in Spring Framework affects applications that construct Content-Disposition HTTP headers by concatenating untrusted user-supplied file names without stripping CRLF characters, allowing remote attackers to inject arbitrary headers into HTTP responses. The vulnerability spans the entire actively-maintained Spring Framework lineage - versions 5.2.x through 7.0.8 - giving it a broad potential surface across Java enterprise application portfolios. No public exploit is identified at time of analysis, and EPSS at 0.16% (6th percentile) indicates low current exploitation probability.
Symlink redirection in Spring Integration's Zip/UnZip transformer allows a local unprivileged user sharing the same host to hijack transformer output by pre-creating /tmp/ziptransformer as a symlink before application startup. Affected versions span the 6.4, 6.5, 7.0, and 7.1 release lines, covering a wide range of enterprise Java deployments that use Spring Integration's file transformation capabilities. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the integrity and availability impact is rated High by the vendor-assigned CVSS score.
Spring Cloud Stream versions 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6 expose a deserialization of untrusted types flaw that could allow a network-positioned attacker with high privileges and required user interaction to gain limited read and write access to application data. The CVSS vector (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) reflects heavy exploitation constraints, making real-world abuse unlikely without insider-level access and specific preconditions. No public exploit code has been identified and the vulnerability is absent from CISA KEV at time of analysis.
Spring Cloud Stream's partition interceptor logic improperly inserts a partition interceptor during message sends under specific conditions, potentially routing messages to unintended partitions. Affected versions span three active release lines: 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6. An authenticated operator with high privileges who triggers a message send under the required conditions could cause limited information disclosure or message integrity degradation by routing data to an unintended partition consumer. No public exploit identified at time of analysis; CVSS score of 3.1 reflects the high access bar and narrow impact.
Improper content-type caching in the Avro component of Spring Cloud Stream can produce incorrect content-type metadata on processed messages, creating a low-severity information-disclosure and data-integrity risk. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release trains. Exploitation requires network access, high privilege level, high attack complexity, and user interaction, making real-world impact minimal; no public exploit code or active exploitation has been identified at time of analysis.
Spring Cloud Stream's dynamic destination cache lacks an upper bound on its size, exposing applications to limited information disclosure and integrity concerns under constrained conditions. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release lines, reported by VMware (Broadcom), the Spring project maintainer. No public exploit code exists and the vulnerability is not listed in CISA KEV; the low CVSS score of 3.1 reflects the highly constrained exploitation prerequisites including high privilege requirements and user interaction.
Sensitive data exposure in Spring Cloud Stream versions 4.2.0-4.2.6, 4.3.0-4.3.3, and 5.0.0-5.0.2 allows logging of sensitive information - such as message payloads, headers, or configuration values - under specific conditions. The vulnerability is classified as information disclosure with a low CVSS base score of 3.1, reflecting the high attack complexity and privilege requirements. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Spring Cloud Function's Azure integration may inadvertently log sensitive data across three affected release lines (4.2.0-4.2.7, 4.3.0-4.3.4, 5.0.0-5.0.3), resulting in low-impact information disclosure. The vulnerability is constrained by a high-privilege, high-complexity, user-interaction-required exploitation profile (CVSS 3.1), making it a low-priority issue for most organizations. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog; the primary risk is credential or token leakage through application log aggregators accessible to operators or compromised log pipelines.
Spring Cloud Function's AWS adapter component may inadvertently write sensitive data to application logs, creating an information disclosure exposure across a wide range of maintained version branches (3.x through 5.x). The CVSS score of 3.1 reflects genuinely low severity - exploitation requires high privileges and high attack complexity - but the risk in regulated or multi-tenant environments is elevated if log stores are accessible to unauthorized parties or if sensitive data (credentials, payloads, tokens) persists in cloud-native logging services such as AWS CloudWatch. No public exploit code exists and no active exploitation has been identified at time of analysis.
Spring Cloud Function's composition lookup mechanism can be abused by a highly privileged attacker to poison the base function, potentially degrading the integrity and confidentiality of function execution across versions 3.2.16 and earlier through 5.0.3. The vendor-assigned CVSS base score of 3.1 reflects severely constrained exploitation prerequisites - high privilege level, high attack complexity, and required user interaction - substantially limiting realistic exposure. No public exploit code has been identified, and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
HTTP header filtering deficiency in Spring Cloud Function versions 5.0.0-5.0.3, 4.3.0-4.3.4, 4.2.0-4.2.7, and 3.2.16 and earlier allows network-accessible authenticated attackers - under high-complexity conditions and requiring user interaction - to achieve limited confidentiality and integrity impacts via crafted HTTP headers. Reported by VMware, the flaw scores 3.1 (Low) under CVSS 3.1, with multiple compounding prerequisites that substantially restrict real-world exploitability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Spring Cloud Function's ServerlessHttpServletRequest.isSecure() method returns an unchecked result that does not reflect the actual HTTP transport scheme, enabling applications that gate security decisions on this call to behave incorrectly. Affected versions span three active release lines: 5.0.0-5.0.3, 4.3.0-4.3.4, and 4.2.0-4.2.7. No public exploit code exists and the vulnerability is not listed in CISA KEV; the vendor-assigned CVSS of 3.1 (Low) reflects constrained exploitation prerequisites including high privilege and user interaction.
Path traversal in Spring AI's ResourceCacheService allows an authenticated low-privileged network attacker to write files outside the intended cache directory. The getCacheName() method appends URI fragments verbatim - including '../' sequences and path separators - to a base directory path before passing the result to new File(resourceParentFolder, newFileName) and writing downloaded bytes there. Affected versions span Spring AI 1.0.9 and earlier, 1.1.0 through 1.1.8, and 2.0.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Spring Integration's jCIFS-based SMB client silently negotiates down to legacy SMB1/CIFS when applications omit an explicit `smbMinVersion` setting, exposing file transfer sessions to NTLM relay attacks and in-transit content tampering by a network-positioned adversary. Affected versions span Spring Integration 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, and the standalone release 7.1.0 - covering all currently active Spring Integration release trains at time of disclosure. No CISA KEV listing or public exploit code specific to this CVE has been identified at time of analysis, though NTLM relay is a mature, extensively tooled attack class; EPSS data was not available in the sourced intelligence.
Spring Integration's default file-based metadata store writes persistent state to a world-readable file under java.io.tmpdir, exposing integration metadata to any local OS user on the affected host. All actively maintained branches are affected, spanning versions 5.5.21 and earlier through 7.1.0. No public exploit code or active exploitation has been identified at time of analysis; practical impact is limited to local confidentiality disclosure on shared or multi-user systems.
Spring Cloud Function versions across three actively maintained release lines (4.2.x, 4.3.x, and 5.0.x) are affected by a potential arbitrary file read and SSRF vulnerability reported by VMware. The vendor-assigned CVSS 3.1 score of 2.0 reflects severe constraints on exploitability - high privilege requirements (PR:H), required user interaction (UI:R), and high attack complexity (AC:H) together make opportunistic or unauthenticated exploitation implausible. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Resource exhaustion in Spring for GraphQL's WebSocket client allows unauthenticated remote attackers to trigger a Denial of Service when the keepAlive feature is enabled. Three release trains are affected: 1.3.x through 1.3.9, 1.4.x through 1.4.6, and 2.0.x through 2.0.4, as confirmed by the VMware/Spring vendor advisory. No public exploit code has been identified and EPSS at 0.15% (4th percentile) indicates low near-term exploitation probability, though the lack of authentication requirement warrants patching for any deployment exposing WebSocket endpoints to untrusted networks.
Reflected XSS in Spring Framework's MVC and WebFlux data-binding error rendering exposes users of vulnerable applications to arbitrary HTML and JavaScript injection. All active Spring Framework release trains are affected - versions 5.2.x through 7.0.8 - making the exposure surface extremely broad across enterprise Java deployments. An unauthenticated attacker (per CVSS PR:N) can craft a malicious URL containing injected script payloads that, when a victim clicks it, execute in the victim's browser context via reflected field-error output. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating limited observed exploitation activity at time of analysis.
Spring Security 7.1.0's InetAddressMatchers utility contains a flaw in its IP address classification logic - the matchInternal() and matchExternal() builders may incorrectly categorize certain IP addresses as belonging to internal or external networks, enabling unauthenticated remote attackers to bypass IP-based access controls under high-complexity conditions. Applications that rely on InetAddressMatchers to enforce network-level access restrictions are exposed to limited information disclosure where restricted endpoints or data may become accessible to external parties. No public exploit code exists and no CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis.
Timing side-channel exposure in Spring Security allows remote unauthenticated attackers to progressively infer security-sensitive string values - such as CSRF tokens, bearer tokens, or other secrets compared at the application layer - by statistically measuring the time differential between rejection responses. Multiple active Spring Security release trains are affected, spanning versions 5.7.x through 7.1.x, representing a broad swath of production Spring-based Java applications. No public exploit code has been identified at time of analysis, and CISA KEV status is absent; however, the confidentiality impact is rated High in the CVSS vector, reflecting that successful exploitation could fully compromise protected secrets under favorable network conditions.
Path traversal in Spring Framework's FreeMarker integration allows authenticated remote attackers to read arbitrary files from the server's template path when a controller passes user-controlled input directly as a view name. Affected versions span every maintained Spring Framework branch from 5.2.x through 7.0.8, making the exposure broad in the Java ecosystem. No public exploit code or active exploitation has been identified; CISA's SSVC assessment rates technical impact as partial and the vulnerability as non-automatable, consistent with the configuration dependency required to trigger it.
TLS certificate validation is absent by default in Spring AMQP's Log4j2 appender when shipping log events to a RabbitMQ broker, leaving all log traffic fully exposed to man-in-the-middle interception. Spring AMQP versions 2.4.18 and earlier, 3.2.0-3.2.12, 4.0.0-4.0.4, and 4.1.0 are affected when the Log4j2 appender is used with its documented default configuration. No public exploit has been identified at time of analysis, but the high confidentiality and integrity CVSS impact reflects that intercepted log streams may contain API keys, session tokens, and other sensitive application data.
HTTP/1.1 request pipelining in Reactor Netty causes unbounded memory growth, exposing Spring WebFlux applications to availability degradation or denial of service from unauthenticated remote clients. Three release trains are affected - 1.0.x through 1.0.52, 1.1.0 through 1.2.18, and 1.3.0 through 1.3.6 - giving this issue broad coverage across current and legacy Spring reactive deployments. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the low exploitation complexity warrants attention in deployments that expose Reactor Netty directly to the internet.
Directory traversal in Handlebars.java before 4.5.5 lets unauthenticated remote attackers read arbitrary files outside the configured template base directory in Spring MVC applications that use the handlebars-springmvc integration. The flaw specifically affects handlebars-springmvc 4.5.3 and 4.5.4, where the path-containment check added for CVE-2026-63490 validates template locations as raw percent-encoded strings while the template file is ultimately opened through a URL handler that percent-decodes the path, so a request-derived view name containing %2e%2e/ slips past both the view-resolver and loader-side checks. Exploitation is not confirmed in the wild and no public exploit code has been identified at time of analysis, but it requires two non-default conditions to hold simultaneously: a file: template location prefix and a Handlebars view name derived from untrusted request input, which keeps real-world priority moderate despite the 7.5 CVSS score. Impact is limited to confidentiality (arbitrary file read); integrity and availability are unaffected.
Spring Integration's reactive message pipeline leaks reply routing and security headers across concurrent users when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering operator that emits raw payloads, causing one user's replyChannel, correlationId, and security or tenant headers to be applied to another concurrent user's response. Affected versions span the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines across the core Spring Integration library, as confirmed by VMware via the spring.io security advisory. The CVSS 8.2 score reflects network exploitability with no authentication required and high confidentiality impact; no public exploit has been identified at time of analysis.
Stored cross-site scripting in Spring Authorization Server's DefaultConsentPage allows network-accessible, unauthenticated attackers to inject arbitrary JavaScript into the OAuth2 consent screen presented to legitimate users. Affected versions span 1.4.0-1.4.11 and 1.5.0-1.5.8; the attack payload is embedded in a crafted OAuth2 authorization request, persisted server-side, and executed in the victim's browser when they view the consent dialog. No public exploit has been identified at time of analysis, but the low-complexity injection mechanism combined with a CVSS 8.2 base score and high confidentiality impact makes this an urgent remediation target for any deployment relying on the default consent page.
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across Spring Framework 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19 and 7.0.0-7.0.8, where unneutralized CRLF sequences (CWE-93) let an attacker inject into or corrupt the event stream. Reported by VMware/Spring and tagged as Information Disclosure, the flaw can break stream framing and potentially leak or splice data across SSE responses. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), but the vendor-assigned CVSS of 9.8 (all-High impact) sits in tension with the information-disclosure framing and warrants scrutiny.
JdbcMessageStore deserialization allowlist protection in Spring Integration silently fails when the store is configured as a Spring-managed bean, rendering the security control entirely ineffective. Operators who call addAllowedPatterns() to restrict which Java classes can be deserialized from the JDBC message store receive no actual protection - any class remains deserializable despite the configured allowlist - leaving applications exposed to unsafe Java deserialization attacks while operators believe they have hardened the component. Affected across Spring Integration 6.4.x through 7.1.0; no public exploit identified at time of analysis.
Spring for GraphQL's Spring Data pagination integration blindly forwards client-supplied Connection field arguments to the underlying repository without enforcing resource limits, enabling an unauthenticated remote attacker to exhaust JVM heap memory or impose sustained load on the backing datastore via crafted GraphQL pagination queries. Three release branches are affected: 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9, as confirmed by EUVD-2026-67178 and the VMware/Spring security advisory. No public exploit has been identified and the EPSS probability is very low (0.16%, 5th percentile), though the unauthenticated, network-accessible attack path makes any openly exposed endpoint a viable denial-of-service target.
Cross-origin data exfiltration in Spring for GraphQL exposes confidential application data when a victim browses a crafted URL pointing to the bundled GraphiQL interface. The GraphiQL IDE, intended for development use, can be weaponized to direct the victim's authenticated browser session to send GraphQL queries whose responses are leaked to an attacker-controlled origin. All major release lines from 1.0.0 through 2.0.4 are affected; no public exploit has been identified and the EPSS score sits at the 4th percentile, but the high confidentiality impact (C:H) and scope change make this notable for any deployment with GraphiQL exposed beyond trusted networks.
Spring for GraphQL's bundled GraphiQL developer IDE loads third-party JavaScript libraries from a public CDN without Subresource Integrity (SRI) verification, allowing any attacker capable of tampering with CDN responses to inject and execute arbitrary JavaScript in any browser that loads the GraphiQL page. All four maintained release lines are affected (1.0.x through 2.0.4), as confirmed by the VMware/Spring security advisory and EUVD-2026-67175. No public exploit code has been identified at time of analysis, and EPSS at 0.11% (2nd percentile) reflects currently minimal exploitation activity.
Unsafe deserialization in Spring for GraphQL 2.0.0-2.0.4 exposes Java applications to potential remote code execution when processing paginated GraphQL queries. The flaw, classified as CWE-502, allows network-accessible, unauthenticated attackers to supply crafted payloads through pagination parameters that are deserialized server-side without adequate type safety. CVSS 8.1 with AC:H reflects that exploitation hinges on the presence of a suitable Java gadget chain on the application classpath; EPSS of 0.44% (36th percentile) and no KEV listing indicate no widespread exploitation has been observed at time of analysis.
Unrestricted property key injection via Spring Cloud Commons' writable /actuator/env endpoint allows authenticated administrators to POST arbitrary environment properties with no allow-list enforcement, affecting all currently maintained release lines (3.1.10 and earlier through 5.0.2). With CVSS PR:H and a scope change (S:C), exploitation requires admin-level access to the actuator endpoint but can cascade integrity impacts across the entire Spring application context. No public exploit has been identified at time of analysis, and exploitation is gated on a non-default configuration requiring deliberate enablement of write access to the actuator endpoint.
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input escape the restricted SimpleEvaluationContext sandbox when the SpEL bytecode compiler is active, affecting Spring Framework 5.2.x through 7.0.8 across the 5.3, 6.0, 6.1, 6.2 and 7.0 lines. Because SimpleEvaluationContext is the API applications are told to use to safely evaluate untrusted expressions, this bypass can escalate a data-binding-only context into broader method invocation with high integrity and availability impact (CVSS 9.1, CWE-913). There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), indicating no observed mass exploitation yet.
Denial of Service exposure in Spring Framework's data binding infrastructure allows unauthenticated remote attackers to exhaust application resources by submitting crafted property path expressions to any endpoint that binds user-supplied paths onto Java target objects. Affected versions span the entire actively maintained Spring Framework lineage - 5.2.x through 7.0.x - making the aggregate exposure footprint very large. No public exploit is referenced and EPSS sits at 0.15% (4th percentile), indicating low current exploitation activity despite the high CVSS score of 7.5.
Denial of service in Spring Reactor Core exposes reactive Java applications to an infinite-loop condition (CWE-835) when the Flux.bufferTimeout operator is used with fairBackpressure enabled. Affected branches span 3.7.x through 3.7.19 and 3.8.0 through 3.8.6, meaning applications on both supported and legacy release trains are vulnerable. No active exploitation has been identified (SSVC: none), and EPSS probability sits at 0.22%, but the network-accessible nature of reactive endpoints makes this a realistic denial-of-service vector for exposed services using the specific configuration.
Predictable ONNX model cache path creation in Spring AI enables a local attacker on a shared multi-user host to pre-create the cache location and substitute a malicious ONNX model before the application writes its legitimate copy. Affected versions span Spring AI 1.0.0-1.0.9, 1.1.0-1.1.8, and 2.0.0. No public exploit code or CISA KEV listing has been identified at time of analysis; critically, the supplied CVSS vector (AV:N/PR:N) is materially inconsistent with the description's local-access requirement, meaning the raw score of 7.5 substantially overstates the realistic attack surface.
Denial of service in Spring AI's PDF document ingestion crashes the processing thread when parsing a crafted PDF with a deeply nested or cyclic table of contents structure. Affected versions span the 1.0.x and 1.1.x release lines as well as the 2.0.0 release. An unauthenticated remote attacker who can supply a malicious PDF to an application's ingestion pipeline can trigger a StackOverflowError, halting document processing availability with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
WebAuthn user verification bypass in Spring Security exposes applications to authentication circumvention when a distributed HTTP session store is in use. Affected versions span Spring Security 6.4.x through 7.1.0, meaning a broad range of enterprise Spring Boot applications leveraging passwordless/FIDO2 authentication are at risk. An unauthenticated remote attacker with the ability to manipulate the WebAuthn ceremony flow can bypass the user verification check - potentially authenticating as a legitimate user - with no public exploit identified at time of analysis.
Missing authentication on Spring Cloud Config Server's /monitor endpoint lets remote attackers submit unvalidated webhook requests, forcing configuration-refresh events without any credentials. It affects Spring Cloud Config 3.x through 3.1.14, 4.0.0-4.2.8, 4.3.0-4.3.4, and 5.0.0-5.0.4, and is exploitable only when the spring-cloud-config-monitor component is enabled. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile) and CISA SSVC rates exploitation as none and technical impact as only partial, tempering the vendor's 9.8 rating.
Time-of-check-time-of-use (TOCTOU) race condition in Spring Cloud Config Server's SVN backend allows unauthenticated network attackers to manipulate the basedir path between validation and use, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Affected are all branches of Spring Cloud Config through 5.0.4, 4.3.4, 4.2.8, and 3.1.14 and earlier, covering a broad range of enterprise Spring microservices deployments. No public exploit code has been identified and no active exploitation is confirmed; however, the vendor (VMware/Spring) has released patches across all affected branches.
DPoP proof replay attack in Spring Security's DPoPProofJwtDecoderFactory allows unauthenticated network attackers to bypass token binding protections by evicting cached JWT ID entries through request flooding, then replaying captured valid DPoP proofs to impersonate legitimate users. Affected versions span Spring Security 6.5.0-6.5.11, 7.0.0-7.0.6, and 7.1.0, impacting any Java application using Spring Security's DPoP-based OAuth 2.0 validation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H ratings reflect full token-holder impersonation upon successful exploitation.
Predictable shared-secret generation in Spring Tools for Eclipse (5.2.0 and earlier) weakens the authentication protecting Spring Boot DevTools remote-restart uploads to remotely deployed targets such as Docker containers or Cloud Foundry apps. Because the secret is derived from a non-cryptographic PRNG rather than a secure random source, an attacker able to reach the deployed application's DevTools remote endpoint may predict the secret, authenticate restart uploads, and push arbitrary code, yielding remote code execution (CVSS 8.3, scope-changed). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Network exposure of Docker container control ports in Spring Tools for Eclipse (versions 5.2.0 and earlier) occurs because the Boot Dashboard Docker integration binds these ports to 0.0.0.0 (all interfaces) instead of loopback. Any attacker on the same network segment as a developer running the integration can reach the container control interface without authentication, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the flaw is trivially triggered once a developer starts the affected feature.
Remote code execution in the Spring Tools IDE extensions (Spring Tools for Eclipse ≤5.2.0 and for VSCode/Cursor/Theia ≤2.2.0) occurs when a developer launches a Spring Boot application with the 'live information' mode enabled, which exposes an unprotected JMX endpoint that an adjacent-network attacker can abuse to execute arbitrary code on the developer's host. The flaw carries a CVSS 8.0 (High) rating and requires the developer to actively start the app in live mode (UI:R). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Origin validation failure in Spring Cloud Gateway (WebMVC and WebFlux Server variants) allows remote attackers to spoof client identity by injecting X-Forwarded-For and Forwarded headers that the gateway then forwards from untrusted proxies in certain configuration scenarios. The flaw, tracked as CVE-2026-47825 with a CVSS 3.1 base score of 8.6 (Scope:Changed, Integrity:High), affects Spring Cloud Gateway 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x. No public exploit identified at time of analysis, but the trust-boundary nature of the issue makes it an attractive target for downstream authentication and access-control bypass.
Denial-of-service in Spring Cloud Sleuth 3.1.0 through 3.1.13 allows remote unauthenticated attackers to exhaust application availability by sending specially crafted calls processed by the spring-cloud-sleuth-instrumentation library when Spring TX (transaction) instrumentation is enabled. The flaw is network-reachable with low attack complexity and no user interaction (CVSS 7.5, AV:N/AC:L/PR:N), but there is no public exploit identified at time of analysis and no CISA KEV listing. Impact is limited to availability - no confidentiality or integrity compromise is possible.
NoSQL/query injection in Spring AI Vector Stores (1.0.0-1.0.8 and 1.1.0-1.1.7) allows remote unauthenticated attackers to inject special characters into vector-store inputs and force execution of arbitrary queries against Elasticsearch, OpenSearch, and GemFire VectorDB backends. The flaw resides in the spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store components, enabling information disclosure and limited integrity/availability impact against any application embedding Spring AI's vector-store abstraction. No public exploit identified at time of analysis, but the CVSS 8.6 (scope unchanged here, network vector, no privileges) makes this a high-priority patch for any Spring AI deployment ingesting untrusted text.
Authorization bypass in Spring for GraphQL (versions 1.0.0-1.0.6, 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3) allows remote attackers to invoke @Controller data fetcher methods whose security annotations are declared on parent classes or interfaces, because the framework's annotation detection does not consistently resolve annotations across type hierarchies. The flaw is rated CVSS 7.5 (confidentiality-only impact) and no public exploit identified at time of analysis, but the network-reachable, no-privilege CVSS vector makes any affected GraphQL endpoint a meaningful exposure.
Cross-Site WebSocket Hijacking in Spring for GraphQL allows remote attackers to execute arbitrary GraphQL operations under an authenticated victim's identity when the application has enabled the GraphQL WebSocket transport. The flaw stems from missing origin validation on WebSocket handshakes (CWE-346), affecting Spring for GraphQL 1.0.x, 1.3.x, 1.4.x, and 2.0.x branches up to 2.0.3. No public exploit identified at time of analysis, but the high CVSS (8.1) and reliance only on a single victim click make this a meaningful risk for any deployment exposing the WebSocket endpoint.
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated attackers to trigger unsafe deserialization by sending crafted paginated GraphQL queries against Connection-type fields. Exploitation requires that the application expose a paginated (Connection) field and that the classpath contains gadget classes leveraged during deserialization. No public exploit identified at time of analysis; EPSS sits at 0.34% (57th percentile) and the issue is not in CISA KEV, but a vendor patch is available.
Server-Side Request Forgery in Spring Web Services (versions 3.1.0-3.1.8, 4.0.0-4.0.18, 4.1.0-4.1.3, and 5.0.0-5.0.1) allows remote unauthenticated attackers to coerce the server into initiating outbound HTTP connections to attacker-controlled or internal destinations by abusing WS-Addressing ReplyTo/FaultTo headers. The flaw stems from WebServiceMessageSender instances dispatching to destinations taken directly from SOAP request headers without validating that the targets are safe. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
XML External Entity (XXE) exposure in Spring Web Services' Jaxp13XPathTemplate allows remote attackers to abuse XPath evaluation over StreamSource and SAXSource inputs because the underlying parser falls back to the JDK's default DocumentBuilderFactory rather than Spring's hardened configuration. Affected versions span the 3.1.x, 4.0.x, 4.1.x and 5.0.x release lines, and while no public exploit was identified at time of analysis, the CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N) indicates that any service that feeds untrusted XML through this template can be reached by unauthenticated remote attackers. The flaw was reported by VMware/Spring and is tracked in the official Spring security advisory.
Insecure default initialization in Spring Web Services' Wss4jSecurityInterceptor disables WSS4J BSP (WS-I Basic Security Profile) enforcement on inbound RequestData, allowing remote attackers to submit SOAP messages that violate BSP-mandated WS-Security rules. Affected versions span 3.1.0-3.1.8, 4.0.0-4.0.18, 4.1.0-4.1.3, and 5.0.0-5.0.1, with no public exploit identified at time of analysis. The CVSS 8.2 score reflects high integrity impact because protocol-level cryptographic checks expected by downstream consumers are silently weakened.
Path traversal in Spring Integration's FTP/SFTP/SMB inbound adapters allows a malicious or compromised remote file server to write attacker-controlled files outside the configured local directory on any client polling it, affecting versions 5.5.0-5.5.20, 6.3.0-6.3.14, 6.4.0-6.4.11, 6.5.0-6.5.8, and 7.0.0-7.0.4. The flaw inverts the usual trust model - the file-transfer client trusts the server's filename, enabling overwrite of arbitrary host files such as configuration, cron, or application JARs, which can escalate to code execution. No public exploit identified at time of analysis, but the issue is straightforward to weaponize once a hostile server endpoint is reachable.
Memory exhaustion in Spring HATEOAS versions 1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, and 3.0.0-3.0.3 allows remote unauthenticated attackers to cause denial of service by sending requests with attacker-controlled link relation strings that accumulate indefinitely in an unbounded static cache of StringLinkRelation instances. With a CVSS 7.5 (high availability impact) and no public exploit identified at time of analysis, the issue is straightforward to trigger against any internet-facing Spring HATEOAS endpoint that derives link relations from request data. Not listed in CISA KEV.
Denial-of-service via improper access control in Spring HATEOAS affects versions 1.5.0-1.5.6, 2.3.0-2.3.4, 2.4.0-2.4.1, 2.5.0-2.5.2, and 3.0.0-3.0.3, where the internal PropertyUtils.createObjectFromProperties method performs reflection-based bean property binding while ignoring Jackson access-control annotations (@JsonIgnore, @JsonProperty access modes). Remote unauthenticated attackers sending crafted Collection+JSON or UBER media type payloads can bind to properties the developer explicitly marked as inbound-restricted, causing high-availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJsonMessageConverter) lets an attacker who controls JMS message content instantiate arbitrary classes, enabling gadget-chain attacks that can escalate to unauthorized actions or remote code execution. It affects Spring Framework 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7 when applications consume messages from an untrusted JMS source. There is no public exploit identified at time of analysis, and despite a 9.8 CVSS the EPSS probability is only 0.04% and CISA SSVC rates exploitation as 'none'.
Denial of service in VMware's Spring Framework (versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7) lets remote attackers exhaust memory in applications that evaluate user-supplied Spring Expression Language (SpEL) expressions, where crafted expressions trigger unbounded internal cache growth. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N), and the impact is availability-only (C:N/I:N/A:H). There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.01%, 2nd percentile), though CISA's SSVC framework flags the issue as automatable.
Algorithmic denial of service in Spring Framework SpEL evaluation allows remote unauthenticated attackers to exhaust CPU/memory resources by submitting specially crafted Spring Expression Language expressions, degrading or crashing affected applications. Impacts Spring Framework 5.3.x through 7.0.x in any application that evaluates user-supplied SpEL. No public exploit identified at time of analysis, and the CVSS 7.5 score reflects high availability impact with no confidentiality or integrity compromise.
Denial of service in Spring Framework 5.3.0 through 5.3.48 allows remote unauthenticated attackers to exhaust server resources by submitting crafted Spring Expression Language (SpEL) expressions that trigger an integer overflow during evaluation. The CVSS 7.5 score reflects high availability impact with no confidentiality or integrity loss, and no public exploit identified at time of analysis. Applications that evaluate untrusted SpEL input are at greatest risk.
Denial of service in Spring Framework's AntPathMatcher allows remote unauthenticated attackers to exhaust CPU resources via Regular Expression Denial of Service (ReDoS) when attacker-controlled patterns are passed to match(), matchStart(), or extractUriTemplateVariables(). Affects Spring Framework 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7. No public exploit identified at time of analysis, EPSS is very low (0.01%, 2nd percentile), and SSVC indicates no observed exploitation.
Denial of service in Spring Framework's Spring MVC and WebFlux static resource resolution allows remote unauthenticated attackers to exhaust application resources, affecting versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7. The CVSS 7.5 score reflects high-impact availability damage over the network with no privileges or user interaction, and at time of analysis no public exploit identified at time of analysis. The flaw was reported by VMware (Spring's maintainer) and is tracked under the official Spring Security advisory.
Predictable WebSocket session IDs in Spring Framework's spring-websocket module allow remote attackers to guess or forge session identifiers and, when paired with weak authorization rules, hijack or interact with other users' WebSocket sessions. The flaw affects Spring Framework 5.3.x, 6.1.x, 6.2.x, and 7.0.x prior to patched releases; no public exploit identified at time of analysis and EPSS is very low (0.03%).
Authentication bypass in Spring LDAP's DirContextAuthenticationStrategy allows remote unauthenticated attackers to succeed at LDAP bind operations by supplying any non-empty username paired with an empty or null password, due to the framework failing to reject such anonymous-equivalent bind requests. Affected releases span Spring LDAP 2.4.0-2.4.4, 3.2.0-3.2.17, 3.3.0-3.3.7, and 4.0.0-4.0.3, putting Java applications that delegate authentication to these libraries at risk of impersonating arbitrary users. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial-of-service in Micrometer (micrometer-core, micrometer-jetty11, and micrometer-jetty12) allows remote unauthenticated attackers to exhaust resources by sending specially crafted HTTP requests against applications that expose Micrometer-instrumented endpoints. The flaw affects a wide swath of supported 1.9.x through 1.16.x release lines and carries a CVSS 7.5 (availability-only) impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial-of-service in Micrometer (Spring observability library) versions 1.15.0-1.15.11 and 1.16.0-1.16.5 allows remote unauthenticated attackers to exhaust resources via specially crafted gRPC requests. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) reflecting availability-only impact, the issue is reachable over the network without credentials, though no public exploit identified at time of analysis. Applications embedding Micrometer's gRPC instrumentation are most exposed.
Filter-expression injection in Spring AI's MilvusVectorStore allows remote unauthenticated attackers to manipulate vector database queries by injecting malicious filter expressions through unsanitized document IDs. Affects Spring AI 1.0.0-1.0.6 and 1.1.0-1.1.5. VMware has released patches in versions 1.0.7 and 1.1.6. CVSS 8.6 (High) with network attack vector and no privileges required. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
Remote unauthenticated attackers can access Google Secrets Manager credentials from unintended GCP projects via crafted requests to Spring Cloud Config servers using Google Secrets Manager as a backend. VMware confirmed this high-severity information disclosure vulnerability (CVSS 7.5) affecting all 3.1.x through 5.0.x versions. No CISA KEV listing or public exploit code identified at time of analysis, but the network-accessible attack vector with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N) indicates straightforward exploitation once attackers identify vulnerable Spring Cloud Config deployments with Google Secrets Manager integration.
Time-of-check-time-of-use (TOCTOU) race condition in Spring Cloud Config Server's Git repository cloning mechanism allows local privileged attackers with high-privilege system access to potentially read or modify configuration data intended for other applications. Exploitation requires timing manipulation of the basedir filesystem path between validation and use, enabling symlink attacks or directory substitution. CVSS 7.2 reflects high attack complexity (AC:H) and privileged local access (AV:L/PR:H) requirements, but scope change (S:C) indicates impact beyond the vulnerable component. EPSS data not available; no public exploit identified at time of analysis.
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files from the file system using specially crafted URLs. Affects Spring Cloud Config versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2, with patches available across all branches. The vulnerability achieves CVSS 9.1 (Critical) due to remote exploitation without authentication (AV:N/AC:L/PR:N/UI:N) and high confidentiality/integrity impact, though EPSS and KEV data are not available to confirm active exploitation status. VMware/Spring has released fixes for all affected versions.
Filter expression injection in Spring AI 1.0.0-1.0.5 and 1.1.0-1.1.4 allows remote unauthenticated attackers to manipulate vector store queries through unescaped keys and values in FilterExpressionConverter implementations. The vulnerability enables query language injection across multiple vector database backends, potentially exposing sensitive data (CVSS:C:H) and modifying query results (CVSS:I:L). VMware has released patches in versions 1.0.6 and 1.1.5. No active exploitation confirmed (not in CISA KEV), but the network-accessible attack vector (AV:N/AC:L/PR:N) and code injection classification (CWE-94) indicate significant risk for applications processing untrusted filter expressions.
Timing attack against Spring Boot DevTools remote secret comparison allows adjacent network attackers to recover the shared secret and achieve remote code execution by uploading malicious classes. Affects Spring Boot 2.7.x through 4.0.x when DevTools remote feature is enabled. Attacker must be on same network segment (AV:A) and overcome high attack complexity (timing-based cryptographic weakness), but requires no authentication or user interaction. CVSS 7.5 severity reflects adjacent vector limitation; real-world risk depends heavily on whether DevTools remote restart is enabled in production (not recommended practice) and network segmentation. No confirmed active exploitation (not in CISA KEV). Vendor-released patches available across all affected branches.
Spring Boot's RabbitMQ auto-configuration omits TLS hostname verification when an SSL bundle is configured, enabling a man-in-the-middle attack on the message broker connection. Affected are Spring Boot 4.0.0-4.0.5 and 3.5.0-3.5.13; fixed in 4.0.6 and 3.5.14 respectively per the vendor advisory at spring.io. No active exploitation has been confirmed - CISA KEV status is absent, EPSS is 0.01% (3rd percentile), and SSVC classifies exploitation as none - making this a medium-priority patch for deployments that use SSL bundles with RabbitMQ.
Authorization bypass in Spring Security 7.0.0-7.0.4 allows unauthenticated remote attackers to circumvent access controls when applications use servlet-path-based intercept-url configurations. The framework fails to include the servlet path when computing pattern matches for authorization rules, causing protected endpoints to become accessible without proper authorization checks. No public exploit code identified at time of analysis, but the straightforward bypass condition (misconfigured servlet-path directives) and network attack vector (CVSS AV:N/AC:L/PR:N) make this readily exploitable in affected deployments.
Path matching bypass in Spring Security 7.0.0-7.0.4 allows unauthenticated remote attackers to evade authentication, authorization, and other security controls when applications use securityMatchers(String) with a PathPatternRequestMatcher.Builder bean to prepend servlet paths. Improper matcher configuration causes filter chains to silently fail, leaving protected endpoints exposed without intended security controls. No active exploitation confirmed, but CVSS 7.5 with network attack vector (AV:N/AC:L/PR:N) indicates readily exploitable if applications use the specific configuration pattern. VMware-reported vulnerability requires immediate patching for affected Spring Security 7.x deployments.
Authentication bypass via user impersonation affects Spring Security 7.0.0 through 7.0.4, where the SubjectX500PrincipalExtractor mishandles malformed CN values in X.509 client certificates and extracts the wrong username. Authenticated attackers presenting a carefully crafted certificate can be authenticated as a different (potentially higher-privileged) user. No public exploit identified at time of analysis; EPSS is very low (0.02%) and CISA SSVC marks exploitation as none.
Spring AI Redis vector store implementations expose sensitive data through unescaped TAG field filter injection in versions 1.0.0-1.0.4 and 1.1.0-1.1.3. Unauthenticated remote attackers can craft malicious filter expressions that bypass query boundaries in RediSearch TAG blocks, allowing extraction of unauthorized information from the vector database (CVSS 7.5 High, C:H). No public exploit identified at time of analysis, though the vulnerability is straightforward to exploit given its low attack complexity (AC:L).
Cypher injection in Spring AI Neo4j vector store (versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3) allows unauthenticated remote attackers to access confidential data stored in Neo4j databases. The vulnerability exists in Neo4jVectorFilterExpressionConverter where user-controlled filter expression keys are embedded into Cypher property accessors without proper backtick escaping, enabling attackers to break out of the intended property context and execute arbitrary Cypher queries. CVSS score of 7.5 reflects high confidentiality impact with network accessibility and low attack complexity, though no public exploit has been identified at time of analysis.
Server-Side Request Forgery in Spring AI Bedrock Converse module enables unauthenticated remote attackers to force the application server to issue HTTP requests to arbitrary internal or external destinations by supplying malicious media URLs in multimodal messages. Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 are affected. The vulnerability carries a CVSS score of 8.6 with high confidentiality impact and changed scope, indicating potential access to internal network resources. No public exploit identified at time of analysis.
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Spring Expression Language (SpEL) injection in the SimpleVectorStore component when user-supplied input is incorporated into filter expression keys. This critical vulnerability (CVSS 9.8) enables attackers to execute arbitrary code without authentication on applications using SimpleVectorStore with untrusted filter input. No public exploit identified at time of analysis, though the attack complexity is low and requires no user interaction according to the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing unauthenticated remote attackers to access arbitrary files outside configured search directories by manipulating the profile parameter in requests. This affects Spring Cloud versions 3.1.X before 3.1.13, 4.1.X before 4.1.9, 4.2.X before 4.2.3, 4.3.X before 4.3.2, and 5.0.X before 5.0.2. With a CVSS score of 8.6 indicating high confidentiality impact with some integrity and availability impact, and network-based attack vector requiring no authentication, this represents a significant information disclosure risk for exposed Config Server instances.
Spring Security fails to properly write HTTP response headers in servlet applications across multiple versions (5.7.0-5.7.21, 5.8.0-5.8.23, 6.3.0-6.3.14, 6.4.0-6.4.14, 6.5.0-6.5.8, 7.0.0-7.0.3), allowing attackers to bypass security controls that rely on these headers such as HSTS, X-Frame-Options, or CSP policies. This header omission could enable various attacks including clickjacking, man-in-the-middle attacks, or other exploits depending on which protections are intended. No patch is currently available for this critical vulnerability.
Spring Boot Actuator endpoints can be bypassed for authentication when application endpoints are configured under Health Group paths in versions 4.0 before 4.0.3, 3.5 before 3.5.11, and 3.4 before 3.4.15. An unauthenticated attacker can exploit this path-based misconfiguration to gain unauthorized access to protected resources with high confidence in authentication bypass and partial information disclosure. No patch is currently available.
Unsafe header deserialization in Spring Integration's EmbeddedHeadersJsonMessageMapper exposes applications to header injection across all active release trains (5.5.x through 7.1.0). The decodeNativeFormat method constructs GenericMessage objects with MutableMessageHeaders populated directly from attacker-controlled JSON-deserialized header maps, bypassing sanitization by default in the constructor. Low-privileged network attackers who can submit crafted byte payloads to an affected consumer channel can manipulate message headers, yielding partial confidentiality, integrity, and availability impacts. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV.
Concurrent message processing in Spring Integration's script-backed channels causes shared ScriptEngine state corruption when using JSR-223 engines that declare THREADING=null, such as the Kotlin KTS engine. Affected Spring Integration versions from 5.5.21 and earlier through 7.1.0 are susceptible to cross-message data leakage, where one message's payload or header bindings can bleed into another message's script evaluation context under concurrent load. No public exploit has been identified at time of analysis, and the CVSS 4.2 Medium rating reflects the high attack complexity imposed by the required race condition, though the information disclosure and partial integrity impact are real concerns in multi-tenant or high-throughput deployments.
Link credit exhaustion in Spring AMQP 4.1.0 silently stalls AMQP listener containers when a container-level ErrorHandler is active. Each message delivery whose processing throws an exception permanently consumes one link credit without returning it to the broker; once the pool reaches zero (after the default 100 credits), the broker halts delivery while isRunning() continues to report true, masking the outage from standard health checks. No active exploitation has been confirmed (no CISA KEV listing, no public POC), but this is a realistic denial-of-service condition for any Spring-based messaging consumer running the affected version with an ErrorHandler configured.
RediSearch query injection in Spring AI 2.0.0's RedisChatMemoryRepository grants authenticated low-privilege users read access to all indexed chat messages across every conversation in the Redis index. The findByMetadata() method omits the RediSearchUtil.escape() call consistently applied by sibling methods (get(), clear(), findByTimeRange()), allowing attacker-controlled metadata values to break out of RediSearch tag query clauses via injected syntax such as x} | * and match all documents in the index. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog.
Denial-of-service in Spring for Apache Kafka's `DeadLetterPublishingRecovererFactory` exposes consumer JVMs across all supported branches (2.8.x through 4.1.0) to crash or hang when processing messages with a crafted `retry_topic-original-timestamp` header. An authenticated Kafka producer can inject a ConsumerRecord carrying an oversized or malformed header byte array, which is passed without any length or format validation directly to Java's `BigInteger(byte[])` constructor, triggering heap memory exhaustion or an unhandled exception that disrupts message consumption. No public exploit code has been identified and the CVE does not appear in CISA KEV at time of analysis, but low attack complexity combined with broad version coverage makes this a credible availability threat for any Spring Kafka deployment using retry or dead-letter queue features.
Denial of Service in Spring Cloud Config's Monitor component allows unauthenticated remote attackers to crash or degrade the configuration server by submitting malicious payloads to the webhook endpoint. Affected versions span the 3.x, 4.x, and 5.x release lines, covering a broad installed base of Spring Boot microservice environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated network-accessible attack surface (PR:N, AV:N, AC:L) means exploitation requires minimal capability.
HTTP response splitting in Spring Framework affects applications that construct Content-Disposition HTTP headers by concatenating untrusted user-supplied file names without stripping CRLF characters, allowing remote attackers to inject arbitrary headers into HTTP responses. The vulnerability spans the entire actively-maintained Spring Framework lineage - versions 5.2.x through 7.0.8 - giving it a broad potential surface across Java enterprise application portfolios. No public exploit is identified at time of analysis, and EPSS at 0.16% (6th percentile) indicates low current exploitation probability.
Symlink redirection in Spring Integration's Zip/UnZip transformer allows a local unprivileged user sharing the same host to hijack transformer output by pre-creating /tmp/ziptransformer as a symlink before application startup. Affected versions span the 6.4, 6.5, 7.0, and 7.1 release lines, covering a wide range of enterprise Java deployments that use Spring Integration's file transformation capabilities. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the integrity and availability impact is rated High by the vendor-assigned CVSS score.
Spring Cloud Stream versions 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6 expose a deserialization of untrusted types flaw that could allow a network-positioned attacker with high privileges and required user interaction to gain limited read and write access to application data. The CVSS vector (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) reflects heavy exploitation constraints, making real-world abuse unlikely without insider-level access and specific preconditions. No public exploit code has been identified and the vulnerability is absent from CISA KEV at time of analysis.
Spring Cloud Stream's partition interceptor logic improperly inserts a partition interceptor during message sends under specific conditions, potentially routing messages to unintended partitions. Affected versions span three active release lines: 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6. An authenticated operator with high privileges who triggers a message send under the required conditions could cause limited information disclosure or message integrity degradation by routing data to an unintended partition consumer. No public exploit identified at time of analysis; CVSS score of 3.1 reflects the high access bar and narrow impact.
Improper content-type caching in the Avro component of Spring Cloud Stream can produce incorrect content-type metadata on processed messages, creating a low-severity information-disclosure and data-integrity risk. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release trains. Exploitation requires network access, high privilege level, high attack complexity, and user interaction, making real-world impact minimal; no public exploit code or active exploitation has been identified at time of analysis.
Spring Cloud Stream's dynamic destination cache lacks an upper bound on its size, exposing applications to limited information disclosure and integrity concerns under constrained conditions. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release lines, reported by VMware (Broadcom), the Spring project maintainer. No public exploit code exists and the vulnerability is not listed in CISA KEV; the low CVSS score of 3.1 reflects the highly constrained exploitation prerequisites including high privilege requirements and user interaction.
Sensitive data exposure in Spring Cloud Stream versions 4.2.0-4.2.6, 4.3.0-4.3.3, and 5.0.0-5.0.2 allows logging of sensitive information - such as message payloads, headers, or configuration values - under specific conditions. The vulnerability is classified as information disclosure with a low CVSS base score of 3.1, reflecting the high attack complexity and privilege requirements. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Spring Cloud Function's Azure integration may inadvertently log sensitive data across three affected release lines (4.2.0-4.2.7, 4.3.0-4.3.4, 5.0.0-5.0.3), resulting in low-impact information disclosure. The vulnerability is constrained by a high-privilege, high-complexity, user-interaction-required exploitation profile (CVSS 3.1), making it a low-priority issue for most organizations. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog; the primary risk is credential or token leakage through application log aggregators accessible to operators or compromised log pipelines.
Spring Cloud Function's AWS adapter component may inadvertently write sensitive data to application logs, creating an information disclosure exposure across a wide range of maintained version branches (3.x through 5.x). The CVSS score of 3.1 reflects genuinely low severity - exploitation requires high privileges and high attack complexity - but the risk in regulated or multi-tenant environments is elevated if log stores are accessible to unauthorized parties or if sensitive data (credentials, payloads, tokens) persists in cloud-native logging services such as AWS CloudWatch. No public exploit code exists and no active exploitation has been identified at time of analysis.
Spring Cloud Function's composition lookup mechanism can be abused by a highly privileged attacker to poison the base function, potentially degrading the integrity and confidentiality of function execution across versions 3.2.16 and earlier through 5.0.3. The vendor-assigned CVSS base score of 3.1 reflects severely constrained exploitation prerequisites - high privilege level, high attack complexity, and required user interaction - substantially limiting realistic exposure. No public exploit code has been identified, and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
HTTP header filtering deficiency in Spring Cloud Function versions 5.0.0-5.0.3, 4.3.0-4.3.4, 4.2.0-4.2.7, and 3.2.16 and earlier allows network-accessible authenticated attackers - under high-complexity conditions and requiring user interaction - to achieve limited confidentiality and integrity impacts via crafted HTTP headers. Reported by VMware, the flaw scores 3.1 (Low) under CVSS 3.1, with multiple compounding prerequisites that substantially restrict real-world exploitability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Spring Cloud Function's ServerlessHttpServletRequest.isSecure() method returns an unchecked result that does not reflect the actual HTTP transport scheme, enabling applications that gate security decisions on this call to behave incorrectly. Affected versions span three active release lines: 5.0.0-5.0.3, 4.3.0-4.3.4, and 4.2.0-4.2.7. No public exploit code exists and the vulnerability is not listed in CISA KEV; the vendor-assigned CVSS of 3.1 (Low) reflects constrained exploitation prerequisites including high privilege and user interaction.
Path traversal in Spring AI's ResourceCacheService allows an authenticated low-privileged network attacker to write files outside the intended cache directory. The getCacheName() method appends URI fragments verbatim - including '../' sequences and path separators - to a base directory path before passing the result to new File(resourceParentFolder, newFileName) and writing downloaded bytes there. Affected versions span Spring AI 1.0.9 and earlier, 1.1.0 through 1.1.8, and 2.0.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Spring Integration's jCIFS-based SMB client silently negotiates down to legacy SMB1/CIFS when applications omit an explicit `smbMinVersion` setting, exposing file transfer sessions to NTLM relay attacks and in-transit content tampering by a network-positioned adversary. Affected versions span Spring Integration 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, and the standalone release 7.1.0 - covering all currently active Spring Integration release trains at time of disclosure. No CISA KEV listing or public exploit code specific to this CVE has been identified at time of analysis, though NTLM relay is a mature, extensively tooled attack class; EPSS data was not available in the sourced intelligence.
Spring Integration's default file-based metadata store writes persistent state to a world-readable file under java.io.tmpdir, exposing integration metadata to any local OS user on the affected host. All actively maintained branches are affected, spanning versions 5.5.21 and earlier through 7.1.0. No public exploit code or active exploitation has been identified at time of analysis; practical impact is limited to local confidentiality disclosure on shared or multi-user systems.
Spring Cloud Function versions across three actively maintained release lines (4.2.x, 4.3.x, and 5.0.x) are affected by a potential arbitrary file read and SSRF vulnerability reported by VMware. The vendor-assigned CVSS 3.1 score of 2.0 reflects severe constraints on exploitability - high privilege requirements (PR:H), required user interaction (UI:R), and high attack complexity (AC:H) together make opportunistic or unauthenticated exploitation implausible. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Resource exhaustion in Spring for GraphQL's WebSocket client allows unauthenticated remote attackers to trigger a Denial of Service when the keepAlive feature is enabled. Three release trains are affected: 1.3.x through 1.3.9, 1.4.x through 1.4.6, and 2.0.x through 2.0.4, as confirmed by the VMware/Spring vendor advisory. No public exploit code has been identified and EPSS at 0.15% (4th percentile) indicates low near-term exploitation probability, though the lack of authentication requirement warrants patching for any deployment exposing WebSocket endpoints to untrusted networks.
Reflected XSS in Spring Framework's MVC and WebFlux data-binding error rendering exposes users of vulnerable applications to arbitrary HTML and JavaScript injection. All active Spring Framework release trains are affected - versions 5.2.x through 7.0.8 - making the exposure surface extremely broad across enterprise Java deployments. An unauthenticated attacker (per CVSS PR:N) can craft a malicious URL containing injected script payloads that, when a victim clicks it, execute in the victim's browser context via reflected field-error output. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating limited observed exploitation activity at time of analysis.
Spring Security 7.1.0's InetAddressMatchers utility contains a flaw in its IP address classification logic - the matchInternal() and matchExternal() builders may incorrectly categorize certain IP addresses as belonging to internal or external networks, enabling unauthenticated remote attackers to bypass IP-based access controls under high-complexity conditions. Applications that rely on InetAddressMatchers to enforce network-level access restrictions are exposed to limited information disclosure where restricted endpoints or data may become accessible to external parties. No public exploit code exists and no CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis.
Timing side-channel exposure in Spring Security allows remote unauthenticated attackers to progressively infer security-sensitive string values - such as CSRF tokens, bearer tokens, or other secrets compared at the application layer - by statistically measuring the time differential between rejection responses. Multiple active Spring Security release trains are affected, spanning versions 5.7.x through 7.1.x, representing a broad swath of production Spring-based Java applications. No public exploit code has been identified at time of analysis, and CISA KEV status is absent; however, the confidentiality impact is rated High in the CVSS vector, reflecting that successful exploitation could fully compromise protected secrets under favorable network conditions.
Path traversal in Spring Framework's FreeMarker integration allows authenticated remote attackers to read arbitrary files from the server's template path when a controller passes user-controlled input directly as a view name. Affected versions span every maintained Spring Framework branch from 5.2.x through 7.0.8, making the exposure broad in the Java ecosystem. No public exploit code or active exploitation has been identified; CISA's SSVC assessment rates technical impact as partial and the vulnerability as non-automatable, consistent with the configuration dependency required to trigger it.
TLS certificate validation is absent by default in Spring AMQP's Log4j2 appender when shipping log events to a RabbitMQ broker, leaving all log traffic fully exposed to man-in-the-middle interception. Spring AMQP versions 2.4.18 and earlier, 3.2.0-3.2.12, 4.0.0-4.0.4, and 4.1.0 are affected when the Log4j2 appender is used with its documented default configuration. No public exploit has been identified at time of analysis, but the high confidentiality and integrity CVSS impact reflects that intercepted log streams may contain API keys, session tokens, and other sensitive application data.
HTTP/1.1 request pipelining in Reactor Netty causes unbounded memory growth, exposing Spring WebFlux applications to availability degradation or denial of service from unauthenticated remote clients. Three release trains are affected - 1.0.x through 1.0.52, 1.1.0 through 1.2.18, and 1.3.0 through 1.3.6 - giving this issue broad coverage across current and legacy Spring reactive deployments. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the low exploitation complexity warrants attention in deployments that expose Reactor Netty directly to the internet.