Product by Vmware Tanzu
Spring Framework
20 known vulnerabilities in Spring Framework (Vmware Tanzu), 0 of them actively exploited (CISA KEV).
Key figures
20
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-47884 | Spring Framework Improper Path Limitation in XsltView | 9.8 | |
| Critical | CVE-2026-59313 | Server Sent Event stream corruption in Spring MVC functional web framework | 9.8 | |
| Critical | CVE-2026-47890 | Spring Framework Server Sent Event stream corruption while rendering fragments | 9.8 | |
| Critical | CVE-2026-47892 | Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints | 9.8 | |
| Critical | CVE-2026-47891 | Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder | 9.8 | |
| Critical | CVE-2026-59283 | Spring Framework Safety Guard Bypass via SpEL Expression Compilation | 9.1 | |
| Medium | CVE-2023-20863 | Spring Framework: Uncontrolled Resource Consumption | 6.5 | |
| High | CVE-2026-47893 | Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService | 7.5 | |
| High | CVE-2026-59282 | Spring Framework Denial of Service via Unbounded List Growth in Data Binding | 7.5 | |
| High | CVE-2026-47888 | Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler | 7.5 | |
| High | CVE-2026-47886 | Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions | 7.5 | |
| High | CVE-2026-47889 | Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse | 7.5 | |
| High | CVE-2026-47885 | Spring Framework maxPartSize Ignored in PartEventHttpMessageReader | 7.5 | |
| High | CVE-2025-41249 | VMware Spring Framework: security vulnerability | 7.5 | |
| Medium | CVE-2026-47883 | Spring Framework Open Redirect in UrlHandlerFilter | 6.1 | |
| Medium | CVE-2026-59281 | Spring Framework Cross-site Scripting via EscapedErrors | 6.1 | |
| Medium | CVE-2026-47887 | Spring Framework Open Redirect in UrlFileNameViewController | 6.1 | |
| Medium | CVE-2026-59280 | Spring Framework Path Traversal via Backslash in SpringTemplateLoader | 4.3 | |
| Medium | CVE-2025-41254 | Spring Framework STOMP CSRF Vulnerability | 4.3 | |
| Low | CVE-2026-59314 | Spring Framework response splitting in ContentDisposition | 3.7 |