Spring vulnerabilities

CVEs per yearBy the year they were published

1. 201910
2. 20202
3. 20237
4. 202415
5. 20258
6. 2026205

Newest CVEs

• CVE-2026-59324

  fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

  Spring · Spring Integration

  High8.2
• CVE-2026-59322

  EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

  Spring · Spring Integration

  Medium6.3
• CVE-2026-59321

  Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

  Spring · Spring Integration

  Medium4.2
• CVE-2026-59320

  In Spring AMQP the link credit never replenished on listener exception path

  Spring · Spring AMQP

  Medium6.5
• CVE-2026-59319

  RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure

  Spring · Spring AI

  Medium4.3
• CVE-2026-59317

  In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop

  Spring · Spring for Apache Kafka

  Medium6.5
• CVE-2026-59316

  Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

  Spring · Spring Authorization Server

  High8.2
• CVE-2026-59315

  Spring Cloud Config Monitor Denial of Service

  Spring · Spring Cloud Config

  Medium5.3
• CVE-2026-59314

  Spring Framework response splitting in ContentDisposition

  Spring · Spring Framework

  Low3.7
• CVE-2026-59311

  Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation

  Spring · Spring Integration

  Medium6.8