Spring vulnerabilities
Published CVEs affecting Spring products: 207 record(s), with severity, exploitation and fixes.
Spring Framework 37Spring Security 22Spring AI 18Spring Integration 15Spring Boot 11Spring Cloud Function 8Spring for GraphQL 8Spring Cloud Config 8Spring Web Services 7Spring AMQP 7Spring Tools for Eclipse 6Reactor Netty 6Spring Data REST 6Spring Cloud Stream 5Spring for Apache Kafka 5Micrometer 4Spring Data Commons 4Spring Batch 3Spring HATEOAS 2Spring Web Flow 2Spring Tools for VSCode / Cursor / Theia 2Spring Authorization Server 2Reactor Core 2Spring gRPC 2Spring Data MongoDB 2Spring Cloud Gateway 2Spring Data JPA 1Spring Cloud Commons 1Micrometer Tracing 1Spring Cloud Sleuth 1CLI VSCode Extension 1Spring Cloud 1Spring Data R2DBC 1Spring Data JDBC 1Spring Data Relational 1Spring Data Redis 1Spring Data KeyValue 1Spring Retry 1Spring for Apache Pulsar 1Spring LDAP 1
CVE-2026-22737
Medium · 5.9
CWE-22 Mar 19, 2026
Spring Framework Improper Path Limitation with Script View Templates
Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
CVE-2026-22735
Low · 2.6
CWE-667 Mar 19, 2026
Server Sent Event stream corruption
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
CVE-2026-22733
High · 8.1
CWE-288 Mar 19, 2026
Authentication Bypass under Actuator CloudFoundry endpoints
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.
CVE-2026-22731
High · 8.1
CWE-306 Mar 19, 2026
Authentication Bypass under Actuator Health groups paths
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.
This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.
This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.
CVE-2025-22234
Medium · 5.3
CWE-208 Jan 22, 2026
Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation
The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer valid usernames or other authentication behavior via response-time differences under certain configurations.
CVE-2026-22718
Medium · 6.8
CWE-78 Jan 14, 2026
Command injection vulnerability
The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine.
CVE-2020-5398
High · 7.5
CWE-494 Jan 16, 2020
RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.