CVE-2016-1000027
Pivotal Spring Framework contains unsafe Java deserialization methods
CVE-2016-1000027 is a critical vulnerability (CVSS 9.8) in Vmware Spring Framework, published January 2, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 33.2%, the 98th percentile. Fixed in org.springframework:spring-web 6.0.0.
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
- Record
CVE-2016-1000027- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
- Record
CVE-2016-1000027- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2022-2463
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
- Record
EUVD-2022-2463- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4wrc-f8pq-fpqp
Pivotal Spring Framework contains unsafe Java deserialization methods
Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.
Maintainers recommend investigating alternative components or a potential mitigating control. Version 4.2.6 and 3.2.17 contain enhanced documentation advising users to take precautions against unsafe Java deserialization, version 5.3.0 deprecate the impacted classes and version 6.0.0 removed it entirely.
- Record
GHSA-4wrc-f8pq-fpqp- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
- Record
CVE-2016-1000027- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-1000027
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
- Record
DEBIAN-CVE-2016-1000027- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-4wrc-f8pq-fpqp
Pivotal Spring Framework contains unsafe Java deserialization methods
Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.
Maintainers recommend investigating alternative components or a potential mitigating control. Version 4.2.6 and 3.2.17 contain enhanced documentation advising users to take precautions against unsafe Java deserialization, version 5.3.0 deprecate the impacted classes and version 6.0.0 removed it entirely.
- Record
GHSA-4wrc-f8pq-fpqp- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVRHLW-2026-a06fd4cfdab7ef70
Lightwell Security Advisory: spring-aop 5.3.18.rhlw-00010
Red Hat Lightwell has released org.springframework:spring-aop 5.3.18.rhlw-00010 with a backported security fix.
CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
This patched artifact is a drop-in replacement for org.springframework:spring-aop 5.3.18 from Maven Central.
- Record
RHLW-2026-a06fd4cfdab7ef70- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHLW-2026-a9afa2d7b2973961
Lightwell Security Advisory: spring-web 5.3.18.rhlw-00010
Red Hat Lightwell has released org.springframework:spring-web 5.3.18.rhlw-00010 with backported fixes for CVE-2016-1000027, CVE-2024-22259, CVE-2024-22262, CVE-2024-38809, and CVE-2024-38820.
CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CVE-2024-22259: CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)
CVE-2024-22262: Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
CVE-2024-38809: Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.
Users of affected versions should upgrade to the corresponding fixed version.
Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.
CVE-2024-38820: CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception
This patched artifact is a drop-in replacement for org.springframework:spring-web 5.3.18 from Maven Central.
- Record
RHLW-2026-a9afa2d7b2973961- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2016-1000027 No score
CVE-2016-1000027 in org.springframework:spring-web - Patched by Root
Root has patched CVE-2016-1000027 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2016-1000027- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webMaven |
before 6.0.0 | 6.0.0 |
libspring-javaDebian:12 |
before 4.2.7-1 | 4.2.7-1 |
libspring-javaDebian:13 |
before 4.2.7-1 | 4.2.7-1 |
libspring-javaDebian:14 |
before 4.2.7-1 | 4.2.7-1 |
org.springframework:spring-webMaven |
before 6.0.0, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE |
6.0.0 |
org.springframework:spring-aopRed Hat Lightwell:Maven |
before 5.3.18.rhlw-00010, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE |
5.3.18.rhlw-00010 |
org.springframework:spring-webRed Hat Lightwell:Maven |
before 5.3.18.rhlw-00010, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE |
5.3.18.rhlw-00010 |
org.springframework:spring-webRoot:Maven |
before 5.3.27-aikido.2 | 5.3.27-aikido.25.3.23-aikido.35.3.23-aikido.45.3.23-aikido.55.3.23-aikido.65.3.31-aikido.54.0.3.RELEASE-aikido.34.0.3.RELEASE-aikido.45.3.31-aikido.64.0.3.RELEASE-aikido.54.0.3.RELEASE-aikido.65.3.20-aikido.85.3.14-aikido.84.0.3.RELEASE-aikido.7 |
io.root.org.springframework:spring-webRoot:Maven |
before 5.3.27-root.io.2 | 5.3.27-root.io.25.3.23-root.io.25.3.23-root.io.35.3.23-root.io.45.3.23-root.io.55.3.23-root.io.65.3.31-root.io.54.0.3.RELEASE-root.io.34.0.3.RELEASE-root.io.45.3.31-root.io.64.0.3.RELEASE-root.io.54.0.3.RELEASE-root.io.65.3.20-root.io.85.3.14-root.io.84.0.3.RELEASE-root.io.7 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | artem-smotrakov/cve-2016-1000027-poc | 2021-02-01 |
| PoC in GitHub | tina94happy/Spring-Web-5xx-Mitigated-version | 2023-11-20 |
| PoC in GitHub | yihtserns/spring-web-without-remoting | 2024-02-08 |
| PoC in GitHub | Ragatzino/test-cve-2016-1000027 | 2026-02-13 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected, exploits | OSV |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
tenable.com/security/research/tra-2016-20
raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000027.json
security-tracker.debian.org/tracker/CVE-2016-1000027
bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027
github.com/spring-projects/spring-framework/issues/24434
spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now
Show 23 moreShow less
security.netapp.com/advisory/ntap-20230420-0009
nvd.nist.gov/vuln/detail/CVE-2016-1000027
support.contrastsecurity.com/hc/en-us/articles/4402400830612-Spring-web-Java-Deserialization-CVE-2016-1000027
jira.spring.io/browse/SPR-17143?redirect=false
Left out here: 558 versions. The JSON record has them.