Spring Framework vulnerabilities and fixes

CVEs that mention Spring Framework, ranked by priority. 5 tracked.

Spring Framework has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-08-11. Highest priority: CVE-2026-47882 (score 38/100).

• CVE-2026-47882 HIGH 8.3 UPGRADE When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or
• CVE-2026-73243 MEDIUM 5.8 kkFileView is a universal file online preview project based on Spring Boot
• CVE-2026-73244 MEDIUM 5.3 kkFileView is a universal file online preview project based on Spring Boot
• CVE-2026-59327 MEDIUM 4.4 UPGRADE Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a pl
• CVE-2026-59328 MEDIUM 4.2 UPGRADE Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (

FAQ

How do I fix Spring Framework vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Spring Framework being exploited right now?

None of the tracked Spring Framework CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Spring Framework CVE should I patch first?

CVE-2026-47882 currently ranks highest (38/100): When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or .

← Back to latest CVEs