VMware Tanzu Spring Framework (MVC and WebFlux): Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 5.9
  CVE-2026-22737

  Spring Framework Improper Path Limitation with Script View Templates

  Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framewo…

  Spring Spring Framework thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Mar 19, 2026
• Low 2.6
  CVE-2026-22735

  Server Sent Event stream corruption

  Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

  Spring Spring Foundation thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Mar 19, 2026

Revision history

1. 2026-08-31 #3

   Neue Updates von Dell aufgenommen

2. 2026-05-14 #2

   Neue Updates von IBM aufgenommen

3. 2026-03-19 #1

   Initiale Fassung

References

• Spring Security Advisory CVE-2026-22735 vom 2026-03-19
  https://spring.io/security/cve-2026-22735
• Spring Security Advisory CVE-2026-22737 vom 2026-03-19
  https://spring.io/security/cve-2026-22737
• IBM Security Bulletin 7272823 vom 2026-05-13
  https://www.ibm.com/support/pages/node/7272823
• PDFreactor 12.6.0 Changelog vom 2026-05-13
  https://www.pdfreactor.com/product/changelog.htm
• Dell Security Advisory DSA-2026-386 vom 2026-09-01
  https://www.dell.com/support/kbdoc/000503504/dsa-2026-386-security-update-f