{"id":"CVE-2021-22118","aliases":["CLSA-2025-1762906008","CLSA-2026-1777855419","CLSA-2026-1785030424","CLSA-2026-1785815205","CLSA-2026-1785957662","CLSA-2026-1787070801","CLSA-2026-1789380988","CLSA-2026-1790857021","CLSA-2026-1792687946","CLSA-2026-1793105396","CLSA-2026-1793620971","CLSA-2026-1793897973","CLSA-2026-1793901658","CLSA-2026-1794378394","CLSA-2026-1794378927","CLSA-2026-1794383183","EUVD-2022-3947","GHSA-gfwj-fwqj-fp3v","UBUNTU-CVE-2021-22118"],"status":"published","title":"Improper Privilege Management in Spring Framework","description":"In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00381,"percentile":0.32492,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269","CWE-668"],"published":"2021-05-27T14:48:16Z","modified":"2026-11-11T13:30:03Z","fixes":[{"ecosystem":"Maven","package":"org.springframework:spring-web","fixed_in":["5.2.15","5.3.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","fixed_in":["5.1.19.RELEASE-tuxcare.2","5.2.7.RELEASE-tuxcare.5","5.2.9.RELEASE-tuxcare.5","5.2.8.RELEASE-tuxcare.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"last_affected":"5.2.14"},{"fixed":"5.2.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"last_affected":"5.3.6"},{"fixed":"5.3.7"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.2"}]}],"versions":["5.1.5.RELEASE","5.1.5.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.2"}]}],"versions":["5.1.5.RELEASE","5.1.5.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.2"}]}],"versions":["5.1.5.RELEASE","5.1.5.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.2"}]}],"versions":["5.1.5.RELEASE","5.1.5.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.2"}]}],"versions":["5.1.5.RELEASE","5.1.5.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.2"}]}],"versions":["5.1.5.RELEASE","5.1.5.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.7"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3","5.2.13.RELEASE-tuxcare.4","5.2.13.RELEASE-tuxcare.5","5.2.13.RELEASE-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.7"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3","5.2.13.RELEASE-tuxcare.4","5.2.13.RELEASE-tuxcare.5","5.2.13.RELEASE-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.7"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3","5.2.13.RELEASE-tuxcare.4","5.2.13.RELEASE-tuxcare.5","5.2.13.RELEASE-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.7"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3","5.2.13.RELEASE-tuxcare.4","5.2.13.RELEASE-tuxcare.5","5.2.13.RELEASE-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.20.RELEASE"},{"fixed":"5.1.20.RELEASE-tuxcare.4"}]}],"versions":["5.1.20.RELEASE","5.1.20.RELEASE-tuxcare.1","5.1.20.RELEASE-tuxcare.2","5.1.20.RELEASE-tuxcare.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.20.RELEASE"},{"fixed":"5.1.20.RELEASE-tuxcare.4"}]}],"versions":["5.1.20.RELEASE","5.1.20.RELEASE-tuxcare.1","5.1.20.RELEASE-tuxcare.2","5.1.20.RELEASE-tuxcare.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.20.RELEASE"},{"fixed":"5.1.20.RELEASE-tuxcare.4"}]}],"versions":["5.1.20.RELEASE","5.1.20.RELEASE-tuxcare.1","5.1.20.RELEASE-tuxcare.2","5.1.20.RELEASE-tuxcare.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.20.RELEASE"},{"fixed":"5.1.20.RELEASE-tuxcare.4"}]}],"versions":["5.1.20.RELEASE","5.1.20.RELEASE-tuxcare.1","5.1.20.RELEASE-tuxcare.2","5.1.20.RELEASE-tuxcare.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.1"}]}],"versions":["5.2.11.RELEASE"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.1"}]}],"versions":["5.2.11.RELEASE"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.1"}]}],"versions":["5.2.11.RELEASE"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.1"}]}],"versions":["5.2.11.RELEASE"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.1"}]}],"versions":["5.2.11.RELEASE"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.1"}]}],"versions":["5.2.11.RELEASE"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.1"}]}],"versions":["5.2.11.RELEASE"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.1"}]}],"versions":["5.2.11.RELEASE"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.1"}]}],"versions":["5.2.11.RELEASE"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.1"}]}],"versions":["5.2.11.RELEASE"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.18.RELEASE"},{"fixed":"5.1.18.RELEASE-tuxcare.1"}]}],"versions":["5.1.18.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.18.RELEASE"},{"fixed":"5.1.18.RELEASE-tuxcare.1"}]}],"versions":["5.1.18.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.18.RELEASE"},{"fixed":"5.1.18.RELEASE-tuxcare.1"}]}],"versions":["5.1.18.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.18.RELEASE"},{"fixed":"5.1.18.RELEASE-tuxcare.1"}]}],"versions":["5.1.18.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.18.RELEASE"},{"fixed":"5.1.18.RELEASE-tuxcare.1"}]}],"versions":["5.1.18.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.18.RELEASE"},{"fixed":"5.1.18.RELEASE-tuxcare.1"}]}],"versions":["5.1.18.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.18.RELEASE"},{"fixed":"5.1.18.RELEASE-tuxcare.1"}]}],"versions":["5.1.18.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.18.RELEASE"},{"fixed":"5.1.18.RELEASE-tuxcare.1"}]}],"versions":["5.1.18.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.18.RELEASE"},{"fixed":"5.1.18.RELEASE-tuxcare.1"}]}],"versions":["5.1.18.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.19.RELEASE"},{"fixed":"5.1.19.RELEASE-tuxcare.2"}]}],"versions":["5.1.19.RELEASE","5.1.19.RELEASE-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.7.RELEASE"},{"fixed":"5.1.7.RELEASE-tuxcare.2"}]}],"versions":["5.1.7.RELEASE","5.1.7.RELEASE-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.7.RELEASE"},{"fixed":"5.1.7.RELEASE-tuxcare.2"}]}],"versions":["5.1.7.RELEASE","5.1.7.RELEASE-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.8.RELEASE"},{"fixed":"5.1.8.RELEASE-tuxcare.2"}]}],"versions":["5.1.8.RELEASE","5.1.8.RELEASE-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.8.RELEASE"},{"fixed":"5.1.8.RELEASE-tuxcare.2"}]}],"versions":["5.1.8.RELEASE","5.1.8.RELEASE-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.8.RELEASE"},{"fixed":"5.1.8.RELEASE-tuxcare.2"}]}],"versions":["5.1.8.RELEASE","5.1.8.RELEASE-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.8.RELEASE"},{"fixed":"5.1.8.RELEASE-tuxcare.2"}]}],"versions":["5.1.8.RELEASE","5.1.8.RELEASE-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.8.RELEASE"},{"fixed":"5.1.8.RELEASE-tuxcare.2"}]}],"versions":["5.1.8.RELEASE","5.1.8.RELEASE-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.13.RELEASE"},{"fixed":"5.1.13.RELEASE-tuxcare.3"}]}],"versions":["5.1.13.RELEASE","5.1.13.RELEASE-tuxcare.1","5.1.13.RELEASE-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.13.RELEASE"},{"fixed":"5.1.13.RELEASE-tuxcare.3"}]}],"versions":["5.1.13.RELEASE","5.1.13.RELEASE-tuxcare.1","5.1.13.RELEASE-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.7.RELEASE"},{"fixed":"5.2.7.RELEASE-tuxcare.5"}]}],"versions":["5.2.7.RELEASE","5.2.7.RELEASE-tuxcare.1","5.2.7.RELEASE-tuxcare.2","5.2.7.RELEASE-tuxcare.3","5.2.7.RELEASE-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.9.RELEASE"},{"fixed":"5.2.9.RELEASE-tuxcare.5"}]}],"versions":["5.2.9.RELEASE","5.2.9.RELEASE-tuxcare.1","5.2.9.RELEASE-tuxcare.2","5.2.9.RELEASE-tuxcare.3","5.2.9.RELEASE-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8.RELEASE"},{"fixed":"5.2.8.RELEASE-tuxcare.4"}]}],"versions":["5.2.8.RELEASE","5.2.8.RELEASE-tuxcare.1","5.2.8.RELEASE-tuxcare.2","5.2.8.RELEASE-tuxcare.3"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.15"}]}],"versions":["5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.2.RELEASE","5.2.3.RELEASE","5.2.4.RELEASE","5.2.5.RELEASE","5.2.6.RELEASE","5.2.7.RELEASE","5.2.8.RELEASE","5.2.9.RELEASE"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.7"}]}],"versions":["5.3.0","5.3.1","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6"]}],"products":[{"vendor":"netapp","product":"hci"},{"vendor":"netapp","product":"management_services_for_element_software"},{"vendor":"oracle","product":"commerce_guided_search"},{"vendor":"oracle","product":"communications_brm_-_elastic_charging_engine"},{"vendor":"oracle","product":"communications_cloud_native_core_binding_support_function"},{"vendor":"oracle","product":"communications_cloud_native_core_policy"},{"vendor":"oracle","product":"communications_cloud_native_core_security_edge_protection_proxy"},{"vendor":"oracle","product":"communications_cloud_native_core_service_communication_proxy"},{"vendor":"oracle","product":"communications_cloud_native_core_unified_data_repository"},{"vendor":"oracle","product":"communications_diameter_intelligence_hub"},{"vendor":"oracle","product":"communications_element_manager"},{"vendor":"oracle","product":"communications_interactive_session_recorder"},{"vendor":"oracle","product":"communications_network_integrity"},{"vendor":"oracle","product":"communications_session_report_manager"},{"vendor":"oracle","product":"communications_session_route_manager"},{"vendor":"oracle","product":"communications_unified_inventory_management"},{"vendor":"oracle","product":"documaker"},{"vendor":"oracle","product":"enterprise_data_quality"},{"vendor":"oracle","product":"financial_services_analytical_applications_infrastructure"},{"vendor":"oracle","product":"healthcare_data_repository"},{"vendor":"oracle","product":"insurance_policy_administration"},{"vendor":"oracle","product":"insurance_rules_palette"},{"vendor":"oracle","product":"mysql_enterprise_monitor"},{"vendor":"oracle","product":"retail_assortment_planning"},{"vendor":"oracle","product":"retail_customer_management_and_segmentation_foundation"},{"vendor":"oracle","product":"retail_financial_integration"},{"vendor":"oracle","product":"retail_integration_bus"},{"vendor":"oracle","product":"retail_merchandising_system"},{"vendor":"oracle","product":"retail_order_broker"},{"vendor":"oracle","product":"retail_predictive_application_server"},{"vendor":"oracle","product":"utilities_testing_accelerator"},{"vendor":"vmware","product":"spring framework"},{"vendor":"vmware","product":"spring_framework"}],"references":[{"url":"https://tanzu.vmware.com/security/cve-2021-22118","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210713-0005/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22118","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-framework/issues/26931","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework/commit/0d0d75e25322d8161002d861fff3ec04ba8be5ac","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework/commit/cce60c479c22101f24b2b4abebb6d79440b120d1","tags":["web"]},{"url":"https://spring.io/security/cve-2021-22118","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gfwj-fwqj-fp3v"},{"url":"https://github.com/spring-projects/spring-framework","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20210713-0005","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-22118","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22118","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-22118","description":"In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.","status":"published","published":"2021-05-27T14:48:16Z","modified":"2024-08-03T18:30:23.944Z","cwes":["CWE-269"],"updated_at":"2026-11-02T14:32:57.701381Z"}],"euvd":[{"id":"EUVD-2022-3947","description":"In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.","status":"published","published":"2021-05-27T14:48:16Z","modified":"2024-08-03T18:30:23Z","updated_at":"2026-11-03T03:25:03.638882Z"}],"ghsa":[{"id":"GHSA-gfwj-fwqj-fp3v","title":"Improper Privilege Management in Spring Framework","description":"In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.","status":"published","published":"2022-05-24T19:03:28Z","modified":"2023-07-19T14:39:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269","CWE-668"],"updated_at":"2026-11-02T14:36:57.310051Z"}],"nvd":[{"id":"CVE-2021-22118","description":"In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.","status":"published","published":"2021-05-27T15:15:07.437Z","modified":"2026-06-17T03:36:38.867Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-269","CWE-668"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"CVE-2021-22118","description":"In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.","status":"published","published":"2021-05-27T15:15:07.437Z","modified":"2026-10-24T10:30:25.536329014Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"GHSA-gfwj-fwqj-fp3v","title":"Improper Privilege Management in Spring Framework","description":"In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.","status":"published","published":"2022-05-24T19:03:28Z","modified":"2024-02-20T05:32:02.20905Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269","CWE-668"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"UBUNTU-CVE-2021-22118","description":"In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.","status":"withdrawn","published":"2021-05-27T15:15:00Z","modified":"2026-11-05T11:45:12.805778336Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"CLSA-2025-1762906008","title":"TuxCare security update for org.springframework (13 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 13 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-11-02T19:45:06.085973092Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1777855419","title":"TuxCare security update for org.springframework (6 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 6 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-11-11T01:43:17.808262381Z","updated_at":"2026-11-11T01:47:54.277886Z"},{"id":"CLSA-2026-1785030424","title":"TuxCare security update for org.springframework (14 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 14 CVEs. Fixed in 5.1.9.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-11-02T19:45:44.848387376Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1785815205","title":"TuxCare security update for org.springframework (23 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 23 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-11-02T19:45:49.917621697Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1785957662","title":"TuxCare security update for org.springframework (7 CVEs)","description":"TuxCare rebuilt 4 org.springframework packages to address 7 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.7.","status":"published","published":"2026-08-05T19:21:02Z","modified":"2026-11-02T19:45:50.037606233Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1787070801","title":"TuxCare security update for org.springframework (6 CVEs)","description":"TuxCare rebuilt 4 org.springframework packages to address 6 CVEs. Fixed in 5.1.20.RELEASE-tuxcare.4.","status":"published","published":"2026-08-18T16:33:21Z","modified":"2026-11-02T19:45:54.243377662Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1789380988","title":"TuxCare security update for org.springframework (20 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 20 CVEs. Fixed in 5.2.11.RELEASE-tuxcare.1.","status":"published","published":"2026-09-14T10:16:28Z","modified":"2026-11-02T19:46:15.379985029Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1790857021","title":"TuxCare security update for org.springframework (25 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 25 CVEs. Fixed in 5.1.18.RELEASE-tuxcare.1.","status":"published","published":"2026-10-01T12:17:01Z","modified":"2026-11-02T19:46:25.072257838Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1792687946","title":"TuxCare security update for org.springframework:spring-web (1 CVE)","description":"TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 5.1.19.RELEASE-tuxcare.2.","status":"published","published":"2026-10-22T16:52:26Z","modified":"2026-11-02T19:46:17.778096413Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1793105396","title":"TuxCare security update for org.springframework (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 5.1.7.RELEASE-tuxcare.2.","status":"published","published":"2026-10-27T12:49:56Z","modified":"2026-11-02T19:46:32.177016218Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793620971","title":"TuxCare security update for org.springframework (13 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 13 CVEs. Fixed in 5.2.10.RELEASE-tuxcare.3.","status":"published","published":"2026-11-02T13:02:51Z","modified":"2026-11-02T19:46:33.689179074Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793897973","title":"TuxCare security update for org.springframework (10 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 10 CVEs. Fixed in 5.1.8.RELEASE-tuxcare.2.","status":"published","published":"2026-11-05T17:59:34Z","modified":"2026-11-06T13:15:13.978425143Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793901658","title":"TuxCare security update for org.springframework (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 5.1.13.RELEASE-tuxcare.3.","status":"published","published":"2026-11-05T19:00:59Z","modified":"2026-11-06T13:15:23.290933052Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1794378394","title":"TuxCare security update for org.springframework:spring-web (1 CVE)","description":"TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 5.2.7.RELEASE-tuxcare.5.","status":"published","published":"2026-11-11T07:26:34Z","modified":"2026-11-11T13:30:03.270123615Z","updated_at":"2026-11-11T13:39:54.306536Z"},{"id":"CLSA-2026-1794378927","title":"TuxCare security update for org.springframework:spring-web (1 CVE)","description":"TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 5.2.9.RELEASE-tuxcare.5.","status":"published","published":"2026-11-11T07:35:28Z","modified":"2026-11-11T13:30:03.761801292Z","updated_at":"2026-11-11T13:39:54.306536Z"},{"id":"CLSA-2026-1794383183","title":"TuxCare security update for org.springframework:spring-web (1 CVE)","description":"TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 5.2.8.RELEASE-tuxcare.4.","status":"published","published":"2026-11-11T08:46:24Z","modified":"2026-11-11T13:30:03.264324727Z","updated_at":"2026-11-11T13:39:54.306536Z"}]}}