Security advisories

medium2026-06-09

CVE-2026-41854-Spring Framework Server-Side Request Forgery via UriComponentsBuilder

spring-projects/spring-framework · GHSA-7m2p-62gw-p8qq

high2026-06-09

CVE-2026-41849-Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

spring-projects/spring-framework · GHSA-775g-4xr8-78h8

low2026-06-09

CVE-2026-41848-Spring Framework Denial of Service via AntPathMatcher

spring-projects/spring-framework · GHSA-659m-px2c-25wj

high2026-06-09

CVE-2026-41842-Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

spring-projects/spring-framework · GHSA-x23c-287f-qqv5

medium2026-06-09

CVE-2026-41838-Spring Framework Predictable Session ID in WebSocket Module

spring-projects/spring-framework · GHSA-q723-847q-5g8g

medium2026-06-09

CVE-2026-41715-Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect

reactor/reactor-netty · GHSA-pfc9-2cqg-9wq6

medium2026-06-09

CVE-2026-41841-Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

spring-projects/spring-framework · GHSA-mq64-j8f9-9gcj

high2026-06-09

CVE-2026-41720-Spring LDAP has Authentication Bypass with Empty Password

spring-projects/spring-ldap · GHSA-jrv5-8w28-4265

medium2026-06-09

CVE-2026-41844-Spring Framework Open Redirect in Spring MVC and WebFlux

spring-projects/spring-framework · GHSA-h3qp-gqrc-q736

medium2026-06-09

CVE-2026-41840-Spring Framework Denial of Service via Multipart Requests in WebFlux

spring-projects/spring-framework · GHSA-83f7-v6px-pp3h

high2026-06-09

CVE-2026-41006-Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

spring-projects/spring-hateoas · GHSA-7fxc-486f-32q9

medium2026-06-09

CVE-2026-41843-Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux

spring-projects/spring-framework · GHSA-72pg-x5f8-j25j

medium2026-06-09

CVE-2026-41839-Spring Framework Escalation via Session Fixation in WebFlux

spring-projects/spring-framework · GHSA-4hfh-6x8g-gwpp

high2026-06-09

CVE-2026-41007-Spring HATEOAS heap exhaustion through unbounded internal caching

spring-projects/spring-hateoas · GHSA-439x-6767-44cv

high2026-06-09

CVE-2026-41845-Spring Framework Cross-site Scripting via JavaScriptUtils

spring-projects/spring-framework · GHSA-3chg-m5w7-qfv5

medium2026-06-09

CVE-2026-41710-Spring Retry has Cache Exhaustion in Stateful Retries that leads to Denial of Service

spring-projects/spring-retry · GHSA-2827-2mxx-j8pv

high2026-06-09

CVE-2026-40983-Micrometer gRPC server instrumentation DoS

micrometer-metrics/micrometer · GHSA-w737-wx49-qj23

high2026-06-09

CVE-2026-40984-Micrometer HTTP server instrumentations DoS

micrometer-metrics/micrometer · GHSA-g3pr-3p32-fp23

high2026-06-09

CVE-2026-47737-Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

puma/puma · GHSA-2vqw-3mp8-cgmx

high2026-06-08

CVE-2026-47736-Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

puma/puma · GHSA-qpgp-93vx-g8v8