Product by Spring
Spring Framework
45 known vulnerabilities in Spring Framework (Spring), 0 of them actively exploited (CISA KEV).
Key figures
45
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2020-5398 | Spring Framework: Cross-site Scripting | 8.0 | |
| High | CVE-2024-22243 | Spring Framework: Server-Side Request Forgery (SSRF) | 8.1 | |
| High | CVE-2024-22259 | Spring Framework: Server-Side Request Forgery (SSRF) | 8.1 | |
| Critical | CVE-2026-47884 | Spring Framework Improper Path Limitation in XsltView | 9.8 | |
| Critical | CVE-2026-59313 | Server Sent Event stream corruption in Spring MVC functional web framework | 9.8 | |
| Critical | CVE-2026-47890 | Spring Framework Server Sent Event stream corruption while rendering fragments | 9.8 | |
| Critical | CVE-2026-47892 | Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints | 9.8 | |
| Critical | CVE-2026-47891 | Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder | 9.8 | |
| Critical | CVE-2026-59283 | Spring Framework Safety Guard Bypass via SpEL Expression Compilation | 9.1 | |
| Medium | CVE-2020-5397 | CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux | 5.3 | |
| High | CVE-2024-22262 | Spring Framework: Server-Side Request Forgery (SSRF) | 8.1 | |
| High | CVE-2026-47893 | Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService | 7.5 | |
| High | CVE-2026-59282 | Spring Framework Denial of Service via Unbounded List Growth in Data Binding | 7.5 | |
| High | CVE-2026-47888 | Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler | 7.5 | |
| High | CVE-2026-47886 | Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions | 7.5 | |
| High | CVE-2024-22233 | Spring Framework: Denial of Service | 7.5 | |
| High | CVE-2026-47889 | Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse | 7.5 | |
| High | CVE-2026-47885 | Spring Framework maxPartSize Ignored in PartEventHttpMessageReader | 7.5 | |
| High | CVE-2023-34053 | Spring Framework server Web Observations DoS Vulnerability | 5.3 | |
| High | CVE-2026-41842 | Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux | 7.5 | |
| High | CVE-2026-41850 | Spring Framework Algorithmic Denial of Service via SpEL Expressions | 7.5 | |
| Critical | CVE-2026-41855 | Spring Framework Unsafe Deserialization via Jackson JMS Converters | 8.1 | |
| High | CVE-2026-41849 | Spring Framework Denial of Service via Integer Overflow in SpEL Expressions | 7.5 | |
| Medium | CVE-2026-47883 | Spring Framework Open Redirect in UrlHandlerFilter | 6.1 | |
| Medium | CVE-2026-59281 | Spring Framework Cross-site Scripting via EscapedErrors | 6.1 |