Spring Framework
Approved changes feed: RSS · Atom
cpe:2.3:a:spring:spring_framework:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Spring (4c7a31af-cbd7-516f-b1ce-2d5f574797bc) |
|---|---|
| Product | Spring Framework (d3e92545-deeb-5bbe-bf78-7a5e953e099a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41855 |
vulnerable | 2026-07-29 00:49:31.490565 |
Spring Framework Unsafe Deserialization via Jackson JMS Converters
HIGH (8.1)
In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Published: 2026-06-09T03:51:57.287Z
Updated: 2026-06-27T21:07:12.717Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41854 |
vulnerable | 2026-07-29 00:49:31.490459 |
Spring Framework Server-Side Request Forgery via UriComponentsBuilder
MEDIUM (4.2)
Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.
Published: 2026-06-09T03:51:49.021Z
Updated: 2026-06-27T21:06:18.674Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41853 |
vulnerable | 2026-07-29 00:49:31.490358 |
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
MEDIUM (5.3)
Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Published: 2026-06-09T03:51:44.875Z
Updated: 2026-06-27T21:04:58.496Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41852 |
vulnerable | 2026-07-29 00:49:31.490253 |
Spring Framework Arbitrary Method Invocation in SpEL Expressions
LOW (3.7)
A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Published: 2026-06-09T03:51:39.908Z
Updated: 2026-06-27T21:04:27.613Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41851 |
vulnerable | 2026-07-29 00:49:31.490139 |
Spring Framework Denial of Service via Unbounded Cache in SpEL
MEDIUM (5.3)
Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Published: 2026-06-09T03:51:32.074Z
Updated: 2026-06-27T21:03:56.341Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41850 |
vulnerable | 2026-07-29 00:49:31.489935 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41849 |
vulnerable | 2026-07-29 00:49:31.489828 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41848 |
vulnerable | 2026-07-29 00:49:31.489620 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41847 |
vulnerable | 2026-07-29 00:49:31.489504 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41846 |
vulnerable | 2026-07-29 00:49:31.489305 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41845 |
vulnerable | 2026-07-29 00:49:31.489080 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41844 |
vulnerable | 2026-07-29 00:49:31.488967 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41843 |
vulnerable | 2026-07-29 00:49:31.488738 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41842 |
vulnerable | 2026-07-29 00:49:31.488618 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41841 |
vulnerable | 2026-07-29 00:49:31.488488 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41840 |
vulnerable | 2026-07-29 00:49:31.488285 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41839 |
vulnerable | 2026-07-29 00:49:31.488111 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41838 |
vulnerable | 2026-07-29 00:49:31.487817 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22737 |
vulnerable | 2026-06-08 07:51:13.743515 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-22233 |
vulnerable | 2026-06-08 07:10:52.510836 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-38808 |
vulnerable | 2026-06-08 06:41:48.140693 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-22262 |
vulnerable | 2026-06-08 06:29:34.317039 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-22259 |
vulnerable | 2026-06-08 06:29:34.313035 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-22243 |
vulnerable | 2026-06-08 06:29:34.204558 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-22233 |
vulnerable | 2026-06-08 06:29:34.174270 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-34053 |
vulnerable | 2026-06-08 06:06:24.327687 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5398 |
vulnerable | 2026-06-08 05:26:42.751278 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-5397 |
vulnerable | 2026-06-08 05:26:42.709068 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.