PatchTheCVEspring framework vulnerabilities and fixes
Recent CVEs affecting spring framework, with upgrade or downgrade steps. 20 tracked.
Also searched as: springframework.
spring framework has 20 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 20. Most recent: 2026-08-27. Highest priority: CVE-2026-47884 (score 51/100).
- CVE-2026-22740 MEDIUM 6.5 UPGRADE A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K
- CVE-2026-22745 MEDIUM 5.3 UPGRADE Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resource
- CVE-2026-22741 LOW 3.1 UPGRADE Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More
- CVE-2026-47883 MEDIUM 6.1 UPGRADE UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns
- CVE-2026-47889 HIGH 7.5 UPGRADE A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sa
- CVE-2026-47888 HIGH 7.5 UPGRADE A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 -
- CVE-2026-47886 HIGH 7.5 UPGRADE Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a
- CVE-2026-47887 MEDIUM 6.1 UPGRADE A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not
- CVE-2026-47884 CRITICAL 9.8 UPGRADE Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**"
- CVE-2026-47885 HIGH 7.5 UPGRADE The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize i
- CVE-2026-47890 CRITICAL 9.8 UPGRADE Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) wi
- CVE-2026-47891 CRITICAL 9.8 UPGRADE A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enfo
- CVE-2026-59282 HIGH 7.5 UPGRADE Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property pa
- CVE-2026-59281 MEDIUM 6.1 UPGRADE Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and
- CVE-2026-47892 CRITICAL 9.8 UPGRADE A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a he
- CVE-2026-47893 HIGH 7.5 UPGRADE A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user informat
- CVE-2026-59280 MEDIUM 4.3 UPGRADE Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when
- CVE-2026-59314 LOW 3.7 UPGRADE Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP resp
- CVE-2026-59283 CRITICAL 9.1 UPGRADE Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be
- CVE-2026-59313 CRITICAL 9.8 UPGRADE Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Serv
FAQ
How do I fix spring framework vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is spring framework being exploited right now?
None of the tracked spring framework CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which spring framework CVE should I patch first?
CVE-2026-47884 currently ranks highest (51/100): Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" .