Spring
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Spring product.
RSS Feeds for Spring security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Spring products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Spring Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2026 there have been 207 vulnerabilities in Spring with an average score of 6.3 out of ten. Last year, in 2025 Spring had 13 security vulnerabilities published. That is, 194 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 1.36
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 207 | 6.32 |
| 2025 | 13 | 7.68 |
| 2024 | 22 | 7.17 |
| 2023 | 2 | 7.00 |
It may take a day or so for new Spring vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Spring Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-59324 | Aug 27, 2026 |
Spring Integration (7.1.0) - Concurrent FluxMessageChannel ReplyHeader BugWhen an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier |
|
| CVE-2026-59322 | Aug 27, 2026 |
Spring Integration EMJMM header injection (v6.x-7.1.0)The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier |
|
| CVE-2026-59321 | Aug 27, 2026 |
Spring Integration ScriptEngine Reuse (JSR-223 THREADING=null) before 7.1.0A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers bindings into another message's script evaluation or throwing spurious exceptions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier |
|
| CVE-2026-59320 | Aug 27, 2026 |
Spring AMQP 4.1.0 link credit exhaustion via ErrorHandlerWhen a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0 |
|
| CVE-2026-59319 | Aug 27, 2026 |
RedisChatMemoryRepository.findByMetadata RediSearch Injection in Spring AI 2.0.0RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | *) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index. Spring AI 2.0.0 |
|
| CVE-2026-59317 | Aug 27, 2026 |
Spring Kafka 4.1.0: BigInteger header leads to DoSDeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier |
|
| CVE-2026-59316 | Aug 27, 2026 |
Spring Auth Server 1.5.x XSS in DefaultConsentPage (unencoded user values)Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11 |
|
| CVE-2026-59315 | Aug 27, 2026 |
Spring Cloud Config 3.1.14-5.0.4 DDoS via Malicious PayloadsThe Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier |
|
| CVE-2026-59314 | Aug 27, 2026 |
HTTP Response Splitting via Content-Disposition in Spring 5.2.25.RELEASEApplications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier |
|
| CVE-2026-59311 | Aug 27, 2026 |
Spring Integration <7.1.0: Local File Write via Symlink ZIP/UNZIPA local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 |