Summary
Ein Angreifer kann mehrere Schwachstellen in VMware Tanzu Spring Framework ausnutzen, um beliebigen Code auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, sensible Informationen offenzulegen, offene Weiterleitungen durchzuführen, Daten zu manipulieren oder Denial-of-Service-Zustände zu verursachen.
Product
Das Spring Framework bietet ein Entwicklungsmodell für Java mit Infrastrukturunterstützung auf Anwendungsebene.
Vulnerabilities 16
-
Critical 9.8CVE-2026-47884 Public exploit
Spring Framework Improper Path Limitation in XsltView
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - …
-
Critical 9.8
Spring Framework Server Sent Event stream corruption while rendering fragments
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
-
Critical 9.8
Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 …
-
Critical 9.8
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring …
-
Critical 9.1
Spring Framework Safety Guard Bypass via SpEL Expression Compilation
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Sprin…
-
High 7.5
Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28
-
High 7.5
Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions
Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framewo…
-
High 7.5
Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framewo…
-
High 7.5
Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
-
High 7.5
Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.…
-
High 7.5
Spring Framework Denial of Service via Unbounded List Growth in Data Binding
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring…
-
Medium 6.1CVE-2026-47883 Public exploit
Spring Framework Open Redirect in UrlHandlerFilter
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
-
Medium 6.1
Spring Framework Open Redirect in UrlFileNameViewController
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6…
-
Medium 6.1
Spring Framework Cross-site Scripting via EscapedErrors
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScrip…
-
Medium 4.3
Spring Framework Path Traversal via Backslash in SpringTemplateLoader
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring…
-
Low 3.7
Spring Framework response splitting in ContentDisposition
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.2…
Revision history
-
#4
Neue Updates von Red Hat aufgenommen
-
#3
Referenz(en) aufgenommen: EUVD-2026-67094, EUVD-2026-67196, EUVD-2026-67172, EUVD-2026-67171, EUVD-2026-67170
-
#2
Referenz(en) aufgenommen: EUVD-2026-66860, EUVD-2026-66859, EUVD-2026-66858, EUVD-2026-66857, EUVD-2026-66856, EUVD-2026-66855, EUVD-2026-66854, EUVD-2026-66853, EUVD-2026-66851
-
#1
Initiale Fassung
References
-
Spring Security Advisory CVE-2026-47883 vom 2026-08-20
https://spring.io/security/cve-2026-47883
-
Spring Security Advisory CVE-2026-47884 vom 2026-08-20
https://spring.io/security/cve-2026-47884
-
Spring Security Advisory CVE-2026-47885 vom 2026-08-20
https://spring.io/security/cve-2026-47885
-
Spring Security Advisory CVE-2026-47886 vom 2026-08-20
https://spring.io/security/cve-2026-47886
-
Spring Security Advisory CVE-2026-47887 vom 2026-08-20
https://spring.io/security/cve-2026-47887
-
Spring Security Advisory CVE-2026-47888 vom 2026-08-20
https://spring.io/security/cve-2026-47888
-
Spring Security Advisory CVE-2026-47889 vom 2026-08-20
https://spring.io/security/cve-2026-47889
-
Spring Security Advisory CVE-2026-47890 vom 2026-08-20
https://spring.io/security/cve-2026-47890
-
Spring Security Advisory CVE-2026-47891 vom 2026-08-20
https://spring.io/security/cve-2026-47891
-
Spring Security Advisory CVE-2026-47892 vom 2026-08-20
https://spring.io/security/cve-2026-47892
-
Spring Security Advisory CVE-2026-47893 vom 2026-08-20
https://spring.io/security/cve-2026-47893
-
Spring Security Advisory CVE-2026-59280 vom 2026-08-20
https://spring.io/security/cve-2026-59280
-
Spring Security Advisory CVE-2026-59281 vom 2026-08-20
https://spring.io/security/cve-2026-59281
-
Spring Security Advisory CVE-2026-59282 vom 2026-08-20
https://spring.io/security/cve-2026-59282
-
Spring Security Advisory CVE-2026-59283 vom 2026-08-20
https://spring.io/security/cve-2026-59283
-
Spring Security Advisory CVE-2026-59314 vom 2026-08-20
https://spring.io/security/cve-2026-59314
-
Red Hat Security Advisory RHSA-2026:88150 vom 2026-10-22
https://access.redhat.com/errata/RHSA-2026:88150