Skip to content
OpenAdvisories

Vendor

Spring

247 known vulnerabilities.

Products

Spring Framework 45 Spring Security 29 Spring AI 18 Spring Integration 16 Spring Boot 15 Spring Cloud Config 10 Spring for GraphQL 9 Spring AMQP 8 Spring Cloud Function 8 Spring Web Services 8 Reactor Netty 7 Spring for Apache Kafka 6 Spring Data REST 6 Spring Tools for Eclipse 6 Spring Cloud Stream 5 Spring Batch 4 Spring 4 Micrometer 4 Spring Data Commons 4 Spring HATEOAS 3 Spring Tools for VSCode / Cursor / Theia 2 Spring LDAP 2 Reactor Core 2 Spring Cloud Gateway 2 Spring Data JPA 2 Spring Data MongoDB 2 Spring Web Flow 2 Spring Authorization Server 2 Spring Security OAuth 2 Spring gRPC 2 Micrometer Tracing 1 Cloud Gateway 1 Spring Foundation 1 Spring Cloud Contract 1 Spring Cloud Commons 1 Spring Retry 1 Spring Cloud 1 Spring Statemachine 1 Spring REST Docs 1 Spring Cloud Data Flow 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-47884 Public exploit

    Spring Framework Improper Path Limitation in XsltView

    Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - …

    Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  • Critical 9.1
    CVE-2026-40982 Public exploit

    Spring Cloud Config vulnerable to Path Traversal

    Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spri…

    Spring Spring Cloud Config org.springframework.cloud:spring-cloud-config-server Maven
  • Critical 9.8
    CVE-2026-22738 Public exploit

    SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution

    In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-…

    Spring Spring AI org.springframework.ai:spring-ai-vector-store Maven
  • Critical 10.0
    CVE-2025-41243 Public exploit

    Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

    Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gat…

    Spring Cloud Gateway org.springframework.cloud:spring-cloud-gateway-server-webflux Maven
  • Critical 9.1
    CVE-2024-38821 Public exploit

    Authorization Bypass of Static Resources in WebFlux Applications

    Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be us…

    Spring Spring org.springframework.security:spring-security-web Maven
  • Critical 9.8
    CVE-2024-37084 Public exploit EPSS 35%

    CVE-2024-37084: Remote code execution in Spring Cloud Data Flow

    In Spring Cloud Data Flow versions prior to 2.11.4,  a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server

    Spring Spring Cloud Data Flow org.springframework.cloud:spring-cloud-skipper Maven