# Maven Advisories.

Every Maven Advisory we hold (Java · Kotlin), newest first.

## Records, newest first (an older page)

- [Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource](https://agentprime.io/advisories/GHSA-2mpf-m756-hxjm.md)
  `GHSA-2mpf-m756-hxjm`, `CVE-2026-40998` · Maven `org.springframework.ws:spring-xml`: affected `>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8`, fixed in `5.0.2`, `4.1.4` · CVSS 8.2 High · Not analysed yet · Published 11 Jun 2026 · Tags: XML external entities (XXE)
- [Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML](https://agentprime.io/advisories/GHSA-hw5c-xm3c-v96w.md)
  `GHSA-hw5c-xm3c-v96w`, `CVE-2026-40986` · Maven `org.springframework.webflow:spring-webflow`: affected `>=4.0.0, <4.0.1 || >=3.0.0, <3.0.2 || <=2.5.1`, fixed in `4.0.1`, `3.0.2` · CVSS 4.8 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Spring Boot's Mail Auto-Configuration Does Not Enable SSL Hostname Verification](https://agentprime.io/advisories/GHSA-9wxp-w4px-32vh.md)
  `GHSA-9wxp-w4px-32vh`, `CVE-2026-40992` · Maven `org.springframework.boot:spring-boot-starter-mail`: affected `>=4.0.0, <4.0.7 || >=3.5.0, <3.5.15 || >=3.4.0, <=3.4.16`, fixed in `4.0.7`, `3.5.15` · CVSS 5.0 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: Weak cryptography or TLS
- [Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem](https://agentprime.io/advisories/GHSA-792x-6vq6-j8r9.md)
  `GHSA-792x-6vq6-j8r9`, `CVE-2026-40987` · Maven `org.springframework.integration:spring-integration-file`: affected `>=7.0.0, <7.0.5 || >=6.5.0, <6.5.9 || >=6.4.0, <=6.4.11 || >=6.3.0, <=6.3.14 || <=5.5.20`, fixed in `7.0.5`, `6.5.9` · CVSS 7.1 High · Not analysed yet · Published 11 Jun 2026 · Tags: Path traversal
- [Spring Web Flow has Data Binding Vulnerability with Unified EL Parser](https://agentprime.io/advisories/GHSA-9ggw-87m9-9gfc.md)
  `GHSA-9ggw-87m9-9gfc`, `CVE-2026-40985` · Maven `org.springframework.webflow:spring-webflow`: affected `>=4.0.0, <4.0.1 || >=3.0.0, <3.0.2 || <=2.5.1`, fixed in `4.0.1`, `3.0.2` · CVSS 6.4 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: Code injection
- [Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set](https://agentprime.io/advisories/GHSA-qv8h-rqr3-mph9.md)
  `GHSA-qv8h-rqr3-mph9`, `CVE-2026-53698` · Maven `org.silverpeas.core:silverpeas-core` and 1 more: affected `<=6.4-feature13197`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Path traversal
- [Acknowledgement extension out of memory](https://agentprime.io/advisories/GHSA-cqgj-h8vf-4w59.md)
  `GHSA-cqgj-h8vf-4w59`, `CVE-2025-53114` · Maven `org.cometd.java:cometd-java-server-common`: affected `>=5.0.0, <5.0.23 || >=6.0.0, <6.0.19 || >=7.0.0, <7.0.19 || >=8.0.0, <8.0.9`, fixed in `5.0.23`, `6.0.19`, `7.0.19`, `8.0.9` · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2026 · Tags: Denial of service
- [Jenkins: Missing permission check allows unauthorized cancellation of queue items](https://agentprime.io/advisories/GHSA-mw82-xcg6-gx79.md)
  `GHSA-mw82-xcg6-gx79`, `BIT-jenkins-2026-53438`, `CVE-2026-53438` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.555.3 || >=2.556, <2.568`, fixed in `2.555.3`, `2.568` · CVSS 4.3 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Broken access control
- [Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations](https://agentprime.io/advisories/GHSA-m6wv-wh8g-64xc.md)
  `GHSA-m6wv-wh8g-64xc`, `BIT-jenkins-2026-53442`, `CVE-2026-53442` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.555.3 || >=2.556, <2.568`, fixed in `2.555.3`, `2.568` · CVSS 5.3 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Weak cryptography or TLS
- [Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation](https://agentprime.io/advisories/GHSA-g2xq-2v27-4rh3.md)
  `GHSA-g2xq-2v27-4rh3`, `BIT-jenkins-2026-53435`, `CVE-2026-53435` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.555.3 || >=2.556, <2.568`, fixed in `2.555.3`, `2.568` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.51 · Not analysed yet · Published 10 Jun 2026 · Tags: Insecure deserialization
- [Jenkins exposes other users' timezone and view names to users with Overall/Read permission](https://agentprime.io/advisories/GHSA-g28p-6mcc-v4rv.md)
  `GHSA-g28p-6mcc-v4rv`, `BIT-jenkins-2026-53439`, `CVE-2026-53439` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.555.3 || >=2.556, <2.568`, fixed in `2.555.3`, `2.568` · CVSS 4.3 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Broken access control
- [Jenkins: Stored XSS vulnerability in node offline cause description](https://agentprime.io/advisories/GHSA-93qh-vwrm-c5pw.md)
  `GHSA-93qh-vwrm-c5pw`, `BIT-jenkins-2026-53441`, `CVE-2026-53441` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.483, <2.568`, fixed in `2.568` · CVSS 8.0 High · Not analysed yet · Published 10 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"](https://agentprime.io/advisories/GHSA-92m7-4fpw-2wxm.md)
  `GHSA-92m7-4fpw-2wxm`, `BIT-jenkins-2026-53440`, `CVE-2026-53440` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.555.3 || >=2.556, <2.568`, fixed in `2.555.3`, `2.568` · CVSS 4.3 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Open redirect
- [Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL](https://agentprime.io/advisories/GHSA-463r-5m89-4xfr.md)
  `GHSA-463r-5m89-4xfr`, `BIT-jenkins-2026-53437`, `CVE-2026-53437` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.555.3 || >=2.556, <2.568`, fixed in `2.555.3`, `2.568` · CVSS 4.3 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Open redirect
- [Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL](https://agentprime.io/advisories/GHSA-3rqh-hch3-jhpc.md)
  `GHSA-3rqh-hch3-jhpc`, `BIT-jenkins-2026-53436`, `CVE-2026-53436` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.556, <2.568 || <2.555.3`, fixed in `2.568`, `2.555.3` · CVSS 4.3 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Open redirect
- [Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates](https://agentprime.io/advisories/GHSA-293q-567p-wmwq.md)
  `GHSA-293q-567p-wmwq`, `CVE-2026-47838` · Maven `org.springframework.security:spring-security-web`: affected `>=6.5.0, <6.5.11 || >=6.4.0, <=6.4.13 || >=6.0.0, <=6.3.10 || >=5.8.0, <=5.8.16 || <=5.7.14`, fixed in `6.5.11` · CVSS 6.8 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Authentication bypass
- [In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header](https://agentprime.io/advisories/GHSA-xvfq-4q6q-gxx7.md)
  `GHSA-xvfq-4q6q-gxx7`, `CVE-2026-41726` · Maven `org.springframework.kafka:spring-kafka`: affected `>=4.0.0, <4.0.6 || >=3.3.0, <3.3.16 || >=3.2.0, <=3.2.13 || >=2.9.0, <=2.9.13 || <=2.8.11`, fixed in `4.0.6`, `3.3.16` · CVSS 6.5 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Denial of service
- [In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization](https://agentprime.io/advisories/GHSA-xq69-5h5v-x9x4.md)
  `GHSA-xq69-5h5v-x9x4`, `CVE-2026-41731` · Maven `org.springframework.kafka:spring-kafka`: affected `>=4.0.0, <4.0.6 || >=3.3.0, <3.3.16 || >=3.2.0, <=3.2.13 || >=2.9.0, <=2.9.13 || <=2.8.11`, fixed in `4.0.6`, `3.3.16` · CVSS 8.1 High · Not analysed yet · Published 10 Jun 2026 · Tags: Insecure deserialization
- [Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries](https://agentprime.io/advisories/GHSA-xg2j-3hj6-pc24.md)
  `GHSA-xg2j-3hj6-pc24`, `CVE-2026-41719` · Maven `org.springframework.data:spring-data-keyvalue`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.14 || >=3.0.0, <=3.3.16 || <=2.7.19`, fixed in `4.0.6`, `3.5.12` · CVSS 6.4 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Code injection
- [Spring Data REST potentially exposes persistence-layer internals to HTTP clients](https://agentprime.io/advisories/GHSA-p5mm-xwgq-whfr.md)
  `GHSA-p5mm-xwgq-whfr`, `CVE-2026-41730` · Maven `org.springframework.data:spring-data-rest-core`: affected `>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.3.0, <=4.3.16 || <=3.7.19`, fixed in `5.0.6`, `4.5.12` · CVSS 5.3 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Information disclosure
- [Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations](https://agentprime.io/advisories/GHSA-mwpv-rg79-863c.md)
  `GHSA-mwpv-rg79-863c`, `CVE-2026-41837` · Maven `org.springframework.data:spring-data-rest-core`: affected `>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.3.0, <=4.3.16 || <=3.7.19`, fixed in `5.0.6`, `4.5.12` · CVSS 5.3 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Broken access control
- [Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests](https://agentprime.io/advisories/GHSA-j388-8rm5-p97f.md)
  `GHSA-j388-8rm5-p97f`, `CVE-2026-41729` · Maven `org.springframework.data:spring-data-rest-core`: affected `>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.3.0, <=4.3.16 || <=3.7.19`, fixed in `5.0.6`, `4.5.12` · CVSS 8.1 High · Not analysed yet · Published 10 Jun 2026 · Tags: Code injection
- [Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization](https://agentprime.io/advisories/GHSA-gg69-9wwp-6jx2.md)
  `GHSA-gg69-9wwp-6jx2`, `CVE-2026-41732` · Maven `org.springframework.pulsar:spring-pulsar`: affected `>=2.0.0, <2.0.6 || >=1.2.0, <1.2.18 || <=1.1.17`, fixed in `2.0.6`, `1.2.18` · CVSS 8.1 High · Not analysed yet · Published 10 Jun 2026 · Tags: Insecure deserialization
- [Spring Data REST has Improper Access Control in its JSON Patch Implementation](https://agentprime.io/advisories/GHSA-cv39-x4c6-hhp2.md)
  `GHSA-cv39-x4c6-hhp2`, `CVE-2026-41728` · Maven `org.springframework.data:spring-data-rest-core`: affected `>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.3.0, <=4.3.16 || <=3.7.19`, fixed in `5.0.6`, `4.5.12` · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2026 · Tags: Broken access control
- [Spring Data Commons: Denial of Service via excessive memory allocation in projection binding](https://agentprime.io/advisories/GHSA-5m4m-73w9-8433.md)
  `GHSA-5m4m-73w9-8433`, `CVE-2026-41721` · Maven `org.springframework.data:spring-data-commons`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.14 || >=3.0.0, <=3.3.16 || <=2.7.19`, fixed in `4.0.6`, `3.5.12` · CVSS 5.9 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Denial of service
- [Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation](https://agentprime.io/advisories/GHSA-53w6-v7cv-fc9h.md)
  `GHSA-53w6-v7cv-fc9h`, `CVE-2026-41727` · Maven `org.springframework.kafka:spring-kafka`: affected `>=4.0.0, <4.0.6 || >=3.3.0, <3.3.16 || >=3.2.0, <=3.2.13 || >=2.9.0, <=2.9.13 || <=2.8.11`, fixed in `4.0.6`, `3.3.16` · CVSS 6.5 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: CWE-20
- [Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache](https://agentprime.io/advisories/GHSA-x2r2-rvhq-2mqv.md)
  `GHSA-x2r2-rvhq-2mqv`, `CVE-2026-41706` · Maven `org.springframework.security:spring-security-web`: affected `>=7.0.0, <7.0.6 || >=6.5.0, <6.5.11 || >=6.3.0, <=6.3.16 || >=5.8.0, <=5.8.25 || <=5.7.23`, fixed in `7.0.6`, `6.5.11` · CVSS 6.1 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Open redirect
- [Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads](https://agentprime.io/advisories/GHSA-ww38-37g9-m3q3.md)
  `GHSA-ww38-37g9-m3q3`, `CVE-2026-41694` · Maven `org.springframework.security:spring-security-saml2-service-provider`: affected `>=7.0.0, <7.0.6 || >=6.5.0, <6.5.11 || >=6.4.0, <=6.4.16 || >=6.3.0, <=6.3.16 || >=5.8.0, <=5.8.25 || <=5.7.23`, fixed in `7.0.6`, `6.5.11` · CVSS 3.7 Low · Not analysed yet · Published 10 Jun 2026 · Tags: Weak cryptography or TLS
- [Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean](https://agentprime.io/advisories/GHSA-p8qj-fj6r-w7q9.md)
  `GHSA-p8qj-fj6r-w7q9`, `CVE-2026-41714` · Maven `org.springframework.amqp:spring-amqp`: affected `>=4.0.0, <4.0.4 || >=3.2.0, <3.2.11 || >=3.1.0, <=3.1.15 || <=2.4.17`, fixed in `4.0.4`, `3.2.11` · CVSS 4.0 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Weak cryptography or TLS
- [Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue](https://agentprime.io/advisories/GHSA-p5f7-rjhp-pxvc.md)
  `GHSA-p5f7-rjhp-pxvc`, `CVE-2026-41701` · Maven `org.springframework.amqp:spring-amqp`: affected `>=4.0.0, <4.0.4 || >=3.2.0, <3.2.11 || >=3.1.0, <=3.1.15 || <=2.4.17`, fixed in `4.0.4`, `3.2.11` · CVSS 4.4 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Weak cryptography or TLS
- [Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)](https://agentprime.io/advisories/GHSA-m69x-pw9p-7j3q.md)
  `GHSA-m69x-pw9p-7j3q`, `CVE-2026-40988` · Maven `org.springframework.security:spring-security-saml2-service-provider`: affected `>=7.0.0, <7.0.6 || >=6.5.0, <6.5.11 || >=6.4.0, <=6.4.16 || >=6.3.0, <=6.3.16 || >=5.8.0, <=5.8.25 || <=5.7.23`, fixed in `7.0.6`, `6.5.11` · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2026 · Tags: Denial of service
- [Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods](https://agentprime.io/advisories/GHSA-hc43-m36c-8v33.md)
  `GHSA-hc43-m36c-8v33`, `CVE-2026-41696` · Maven `org.springframework.data:spring-data-mongodb`: affected `>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.0.0, <=4.3.16 || <=3.4.19`, fixed in `5.0.6`, `4.5.12` · CVSS 5.9 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Other injection
- [Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys](https://agentprime.io/advisories/GHSA-9fw2-h3hf-293r.md)
  `GHSA-9fw2-h3hf-293r`, `CVE-2026-41716` · Maven `org.springframework.data:spring-data-commons`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.14 || >=3.3.0, <=3.3.16 || <=2.7.19`, fixed in `4.0.6`, `3.5.12` · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2026 · Tags: Denial of service
- [Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference](https://agentprime.io/advisories/GHSA-8r2h-xh92-gq57.md)
  `GHSA-8r2h-xh92-gq57`, `CVE-2026-41697` · Maven `org.springframework.data:spring-data-relational`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.14 || >=3.0.0, <=3.3.16 || <=2.4.19`, fixed in `4.0.6`, `3.5.12` · CVSS 4.8 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Other injection
- [Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-6rpq-6vv2-5222.md)
  `GHSA-6rpq-6vv2-5222`, `CVE-2026-40991` · Maven `org.springframework.restdocs:spring-restdocs-restassured` and 1 more: affected `>=4.0.0, <4.0.1 || >=3.0.0, <3.0.6 || <=2.0.8.RELEASE`, fixed in `4.0.1`, `3.0.6` · CVSS 5.9 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: XML external entities (XXE)
- [Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection](https://agentprime.io/advisories/GHSA-5whc-4q84-fj73.md)
  `GHSA-5whc-4q84-fj73`, `CVE-2026-41717` · Maven `org.springframework.data:spring-data-mongodb`: affected `>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.0.0, <=4.3.16 || <=3.4.19`, fixed in `5.0.6`, `4.5.12` · CVSS 8.1 High · Not analysed yet · Published 10 Jun 2026 · Tags: Code injection
- [Spring Data Commons: StackOverflowException when parsing Sort parameters (DoS)](https://agentprime.io/advisories/GHSA-5vpf-xvv7-c8vh.md)
  `GHSA-5vpf-xvv7-c8vh`, `CVE-2026-41711` · Maven `org.springframework.data:spring-data-commons`: affected `>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.14 || >=3.0.0, <=3.3.16 || <=2.7.19`, fixed in `4.0.6`, `3.5.12` · CVSS 5.9 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Denial of service
- [Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter](https://agentprime.io/advisories/GHSA-4r8w-73jc-3m7q.md)
  `GHSA-4r8w-73jc-3m7q`, `CVE-2026-41008` · Maven `org.springframework.security:spring-security-oauth2-authorization-server`: affected `>=7.0.0, <7.0.6 || >=1.5.0, <1.5.8`, fixed in `7.0.6`, `1.5.8` · CVSS 6.1 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Open redirect
- [Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters](https://agentprime.io/advisories/GHSA-3pjj-qpw6-5fcm.md)
  `GHSA-3pjj-qpw6-5fcm`, `CVE-2026-41003` · Maven `org.springframework.security:spring-security-saml2-service-provider`: affected `>=7.0.0, <7.0.6 || >=6.5.0, <6.5.11 || >=6.4.0, <=6.4.16 || >=6.3.0, <=6.3.16 || >=5.8.0, <=5.8.25 || <=5.7.23`, fixed in `7.0.6`, `6.5.11` · CVSS 7.6 High · Not analysed yet · Published 10 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository](https://agentprime.io/advisories/GHSA-2q7c-5gjm-7q23.md)
  `GHSA-2q7c-5gjm-7q23`, `CVE-2026-40993` · Maven `org.springframework.security:spring-security-saml2-service-provider`: affected `>=7.0.0, <7.0.6`, fixed in `7.0.6` · CVSS 7.3 High · Not analysed yet · Published 10 Jun 2026 · Tags: Insecure deserialization
- [Spring Framework Unsafe Deserialization via Jackson JMS Converters](https://agentprime.io/advisories/GHSA-x863-p983-p4f7.md)
  `GHSA-x863-p983-p4f7`, `CVE-2026-41855` · Maven `org.springframework:spring-jms`: affected `<=5.3.39 || >=6.0.0, <=6.1.21 || >=6.2.0, <6.2.19 || >=7.0.0-M1, <7.0.8`, fixed in `6.2.19`, `7.0.8` · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: Insecure deserialization
- [Spring Framework Denial of Service via Unbounded Cache in SpEL](https://agentprime.io/advisories/GHSA-wxpp-56q6-5pcg.md)
  `GHSA-wxpp-56q6-5pcg`, `CVE-2026-41851` · Maven `org.springframework:spring-expression`: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL](https://agentprime.io/advisories/GHSA-vqgp-pf68-6947.md)
  `GHSA-vqgp-pf68-6947`, `CVE-2026-41847` · Maven `org.springframework:spring-webflux`: affected `<=5.3.39`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Broken access control
- [Spring Framework Algorithmic Denial of Service via SpEL Expressions](https://agentprime.io/advisories/GHSA-r5w3-xv2f-j59q.md)
  `GHSA-r5w3-xv2f-j59q`, `CVE-2026-41850` · Maven `org.springframework:spring-expression`: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux](https://agentprime.io/advisories/GHSA-cjpg-rgq5-fr37.md)
  `GHSA-cjpg-rgq5-fr37`, `CVE-2026-41853` · Maven `org.springframework:spring-webflux` and 1 more: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: HTTP request smuggling
- [Spring Framework Arbitrary Method Invocation in SpEL Expressions](https://agentprime.io/advisories/GHSA-9f52-rjqv-25qv.md)
  `GHSA-9f52-rjqv-25qv`, `CVE-2026-41852` · Maven `org.springframework:spring-expression`: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 3.7 Low · Not analysed yet · Published 9 Jun 2026 · Tags: Broken access control
- [Spring Framework Cross-site Scripting via JSP Form Tags](https://agentprime.io/advisories/GHSA-957g-f97v-vppc.md)
  `GHSA-957g-f97v-vppc`, `CVE-2026-41846` · Maven `org.springframework:spring-webmvc`: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 5.9 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Cross-site scripting (XSS)
- [Spring Framework Server-Side Request Forgery via UriComponentsBuilder](https://agentprime.io/advisories/GHSA-7m2p-62gw-p8qq.md)
  `GHSA-7m2p-62gw-p8qq`, `CVE-2026-41854` · Maven `org.springframework:spring-web`: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19`, fixed in `7.0.8`, `6.2.19` · CVSS 4.2 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Server-side request forgery (SSRF)
- [Spring Framework Denial of Service via Integer Overflow in SpEL Expressions](https://agentprime.io/advisories/GHSA-775g-4xr8-78h8.md)
  `GHSA-775g-4xr8-78h8`, `CVE-2026-41849` · Maven `org.springframework:spring-expression`: affected `<=5.3.39`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Memory corruption
- [Spring Framework Denial of Service via AntPathMatcher](https://agentprime.io/advisories/GHSA-659m-px2c-25wj.md)
  `GHSA-659m-px2c-25wj`, `CVE-2026-41848` · Maven `org.springframework:spring-core`: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 3.7 Low · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux](https://agentprime.io/advisories/GHSA-x23c-287f-qqv5.md)
  `GHSA-x23c-287f-qqv5`, `CVE-2026-41842` · Maven `org.springframework:spring-webflux` and 1 more: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Spring Framework Predictable Session ID in WebSocket Module](https://agentprime.io/advisories/GHSA-q723-847q-5g8g.md)
  `GHSA-q723-847q-5g8g`, `CVE-2026-41838` · Maven `org.springframework:spring-websocket`: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.27 || <=5.3.48`, fixed in `7.0.8`, `6.2.19` · CVSS 4.8 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Weak cryptography or TLS
- [Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect](https://agentprime.io/advisories/GHSA-pfc9-2cqg-9wq6.md)
  `GHSA-pfc9-2cqg-9wq6`, `CVE-2026-41715` · Maven `io.projectreactor.netty:reactor-netty`: affected `>=1.3.0, <1.3.6 || >=1.2.0, <1.2.18 || >=1.1.0, <=1.1.31 || >=1.0.0, <=1.0.48`, fixed in `1.3.6`, `1.2.18` · CVSS 6.1 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Hard-coded credentials
- [Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux](https://agentprime.io/advisories/GHSA-mq64-j8f9-9gcj.md)
  `GHSA-mq64-j8f9-9gcj`, `CVE-2026-41841` · Maven `org.springframework:spring-webflux` and 1 more: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 5.9 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-524
- [Spring LDAP has Authentication Bypass with Empty Password](https://agentprime.io/advisories/GHSA-jrv5-8w28-4265.md)
  `GHSA-jrv5-8w28-4265`, `CVE-2026-41720` · Maven `org.springframework.ldap:spring-ldap-core`: affected `>=4.0.0, <4.0.4 || >=3.3.0, <3.3.8 || >=3.2.0, <=3.2.16 || <=2.4.4`, fixed in `4.0.4`, `3.3.8` · CVSS 7.4 High · Not analysed yet · Published 9 Jun 2026 · Tags: Authentication bypass
- [Spring Framework Open Redirect in Spring MVC and WebFlux](https://agentprime.io/advisories/GHSA-h3qp-gqrc-q736.md)
  `GHSA-h3qp-gqrc-q736`, `CVE-2026-41844` · Maven `org.springframework:spring-webflux` and 1 more: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 4.2 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Open redirect
- [Spring Framework Denial of Service via Multipart Requests in WebFlux](https://agentprime.io/advisories/GHSA-83f7-v6px-pp3h.md)
  `GHSA-83f7-v6px-pp3h`, `CVE-2026-41840` · Maven `org.springframework:spring-webflux`: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 5.9 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Denial of service
- [Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration](https://agentprime.io/advisories/GHSA-7fxc-486f-32q9.md)
  `GHSA-7fxc-486f-32q9`, `CVE-2026-41006` · Maven `org.springframework.hateoas:spring-hateoas`: affected `>=3.0.0, <3.0.4 || >=2.5.0, <2.5.3 || >=2.3.0, <=2.3.4 || <=1.5.6 || >=2.4.0, <=2.4.1`, fixed in `3.0.4`, `2.5.3` · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Broken access control
- [Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux](https://agentprime.io/advisories/GHSA-72pg-x5f8-j25j.md)
  `GHSA-72pg-x5f8-j25j`, `CVE-2026-41843` · Maven `org.springframework:spring-webflux` and 1 more: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 5.9 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Path traversal
- [Spring Framework Escalation via Session Fixation in WebFlux](https://agentprime.io/advisories/GHSA-4hfh-6x8g-gwpp.md)
  `GHSA-4hfh-6x8g-gwpp`, `CVE-2026-41839` · Maven `org.springframework:spring-webflux`: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39`, fixed in `7.0.8`, `6.2.19` · CVSS 4.2 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/ecosystem/maven.md>
Older: <https://agentprime.io/advisories/ecosystem/maven.md?cursor=WyIyMDI2LTA2LTA5VDA2OjMxOjU3LjAwMDAwMFoiLCJHSFNBLTRoZmgtNng4Zy1nd3BwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Maven&cursor=WyIyMDI2LTA2LTExVDA5OjMxOjU2LjAwMDAwMFoiLCJHSFNBLTV4MjUtYzJyZi1mMmp4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/maven/?cursor=WyIyMDI2LTA2LTExVDA5OjMxOjU2LjAwMDAwMFoiLCJHSFNBLTV4MjUtYzJyZi1mMmp4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.