Advisories · Technology
Spring Framework.
Every CVE that names Spring Framework among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 3.7 Low
Spring Framework response splitting in ContentDisposition
- Spring Framework
- Other injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Server Sent Event stream corruption in Spring MVC functional web framework
- Spring Framework
- Other injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Spring Framework Safety Guard Bypass via SpEL Expression Compilation
- Spring Framework
- CWE-913
- CVSS 7.5 High
Spring Framework Denial of Service via Unbounded List Growth in Data Binding
- Spring Framework
- Denial of service
- CVSS 6.1 Medium
Spring Framework Cross-site Scripting via EscapedErrors
- Spring Framework
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Spring Framework Path Traversal via Backslash in SpringTemplateLoader
- Spring Framework
- Path traversal
- CVSS 7.5 High
Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
- Spring Framework
- Information disclosure
- CVSS 9.8 CriticalCritical · CVSS 9+
Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
- Spring Framework
- Denial of service
- CVSS 7.5 High
Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
- Spring Framework
- CWE-1275
- CVSS 7.5 High
Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
- Spring Framework
- Denial of service
- CVSS 6.1 Medium
Spring Framework Open Redirect in UrlFileNameViewController
- Spring Framework
- Open redirect
- CVSS 7.5 High
Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions
- Spring Framework
- Denial of service
- CVSS 7.5 High
Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
- Spring Framework
- Denial of service
- CVSS 6.1 Medium
Spring Framework Open Redirect in UrlHandlerFilter
- Spring Framework
- Open redirect