Skip to contentVmware Spring vulnerabilities
- spring boot, vmware spring boot +1 moreSpring Boot DevTools remote secret comparison is vulnerable to timing attacksCVE-2026-40972Fix available7.5 High
- spring boot, vmware spring boot +1 moreSpring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ brokerCVE-2026-40971Fix available5.0 Medium
- spring boot, vmware spring boot +1 moreSpring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.CVE-2026-40970Fix available5.0 Medium
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreervlet Path Not Correctly Included in Path Matching of XML Authorization RulesCVE-2026-22754Fix available7.5 High
- spring security, vmware spring security +1 moreServlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchersCVE-2026-22753Fix available7.5 High
- spring security, vmware spring security +1 morePotential Security Misconfiguration when Using withIssuerLocationCVE-2026-22748Fix available5.3 Medium
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreUnauthorized User Impersonation when Using X.509 Client CertificatesCVE-2026-22747Public exploitFix available6.8 Medium
- spring security, vmware spring security +1 moreUser Attribute Enumeration when Using DaoAuthenticationProviderCVE-2026-22746Fix available3.7 Low
- spring security, vmware spring security +1 moreSpring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessionsCVE-2026-22751Fix available4.8 Medium
- vmware spring cloud gatewaySSL bundle configuration silently bypassed in Spring Cloud GatewayCVE-2026-22750Fix available7.5 High
- spring ai, vmware spring ai +1 moreSpring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special CharactersCVE-2026-22744Fix available7.5 High
- spring ai, vmware spring ai +1 moreServer-Side Request Forgery via Filter Expression Keys in Neo4jVectorStoreCVE-2026-22743Fix available7.5 High
- spring ai, vmware spring ai +1 moreServer-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL FetchingCVE-2026-22742Fix available8.6 High
- spring ai, vmware spring ai +1 moreSpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code ExecutionCVE-2026-22738Public exploitFix available9.8 Critical
- spring cloud, vmware spring cloud config +1 moreSpring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF AttacksCVE-2026-22739Fix available8.6 High
- spring framework, vmware spring framework +1 moreSpring Framework Improper Path Limitation with Script View TemplatesCVE-2026-22737Fix available5.9 Medium
- spring foundation, vmware spring framework +1 moreServer Sent Event stream corruptionCVE-2026-22735Fix available2.6 Low
- spring security, vmware spring boot +1 moreAuthentication Bypass under Actuator CloudFoundry endpointsCVE-2026-22733Fix available8.2 High
- spring security, vmware spring security +1 moreUnder Some Conditions Spring Security HTTP Headers Are not WrittenCVE-2026-22732Public exploitFix available9.1 Critical
- spring boot, vmware spring boot +1 moreAuthentication Bypass under Actuator Health groups pathsCVE-2026-22731Fix available8.2 High
- vmware spring aiCVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverterCVE-2026-22729Fix available8.6 High
- vmware spring aiCVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverterCVE-2026-22730Public exploitFix available8.8 High
- vmware spring data geode, red hat fuse 7, vmware spring data gemfire +2 moreZip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific)CVE-2026-28188.2 High
- vmware spring data geode, spring data gemfire +1 moreSpring Data Geode Insecure Temporary Directory UsageCVE-2026-28174.8 Medium
- vmware spring frameworkSpring Framework STOMP CSRF VulnerabilityCVE-2025-41254Fix available4.3 Medium
- vmware spring cloud gateway server webfluxSpring Cloud Gateway Webflux SpEL Injection Vulnerability Allowing Exposure of Environment VariablesCVE-2025-41253Fix available7.5 High
- vmware spring frameworkCVE-2025-41249: Spring Framework Annotation Detection VulnerabilityCVE-2025-41249Public exploitFix available7.5 High
- spring security, vmware spring security +1 moreCVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized typesCVE-2025-41248Fix available7.5 High
- vmware spring frameworkCVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containersCVE-2025-41242Public exploitFix available5.9 Medium
- vmware spring frameworkRFD Attack via “Content-Disposition” Header Sourced from RequestCVE-2025-41234Fix available6.5 Medium
- vmware spring cloud gateway, spring cloud gateway server mvc +1 moreCVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted ProxiesCVE-2025-41235Fix available8.6 High
- spring framework, vmware spring framework +1 moreSpring Framework DataBinder Case Sensitive Match ExceptionCVE-2025-22233Fix available3.1 Low
- vmware spring frameworkSpring Framework Path Traversal vulnerabilityCVE-2024-38819Public exploitFix availableEPSS 56.5%7.5 High
- springCVE-2024-38828: DoS via Spring MVC controller method with byte[] parameterCVE-2024-38828Public exploitFix available5.3 Medium
- spring, spring webflux +1 moreAuthorization Bypass of Static Resources in WebFlux ApplicationsCVE-2024-38821Public exploitFix available9.1 Critical
- vmware spring, spring framework +1 moreCVE-2024-38820: Spring Framework DataBinder Case Sensitive Match ExceptionCVE-2024-38820Public exploitFix available3.1 Low
- vmware spring frameworkSpring Framework DoS via conditional HTTP requestCVE-2024-38809Fix available5.3 Medium
- spring, spring by vmware tanzu framework +1 moreCVE-2024-38816: Path traversal vulnerability in functional web frameworksCVE-2024-38816Public exploitFix availableEPSS 21.3%7.5 High
- spring framework, vmware spring framework, netapp active iq unified manager +1 more +3 moreCVE-2024-38808: Spring Expression DoS VulnerabilityCVE-2024-38808Fix available4.3 Medium
- spring security, vmware spring security +1 moreMissing Authorization When Using @AuthorizeReturnObjectCVE-2024-38810Fix available6.5 Medium
- spring cloud data flow, vmware spring cloud data flow +1 moreCVE-2024-37084: Remote code execution in Spring Cloud Data FlowCVE-2024-37084Public exploitFix availableEPSS 35.2%9.8 Critical
- spring by vmware tanzu cloud function framework, vmware spring cloud function +1 moreSpring Cloud Function Web DOS VulnerabilityCVE-2024-22271Fix available8.2 High
- spring framework, vmware spring framework +1 moreCVE-2024-22262: Spring Framework URL Parsing with Host ValidationCVE-2024-22262Public exploitFix available8.1 High
- springCVE-2024-22258: PKCE Downgrade in Spring Authorization ServerCVE-2024-22258Fix available6.1 Medium
- spring framework, vmware spring framework, netapp active iq unified manager +2 moreCVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)CVE-2024-22259Fix available8.1 High
- pivotal software spring framework, spring framework, netapp active iq unified manager +2 moreCVE-2024-22243: Spring Framework URL Parsing with Host ValidationCVE-2024-22243Public exploitFix available8.1 High
- spring security, vmware spring security +1 moreCVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticatedCVE-2024-22234Fix available7.4 High
- spring security, vmware spring security +1 moreSpring Security's spring-security.xsd file is world writableCVE-2023-34042Fix available4.1 Medium
- spring cloud contract, vmware spring cloud contract +1 moreSpring Cloud Contract vulnerable to local information disclosureCVE-2024-22236Fix available3.3 Low
- spring framework, vmware spring framework +1 moreCVE-2024-22233: Spring Framework server Web DoS VulnerabilityCVE-2024-22233Fix available7.5 High
- Show moreLoading…