PatchSiren

Spring CVE debriefs · Page 5

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Spring CVE published 2026-06-09

CVE-2026-41838

CVE-2026-41838 is a medium severity vulnerability in the Spring Framework. The IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. This vulnerability affects Spring Framework versions 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.

HIGH Spring CVE published 2026-06-09

CVE-2026-41720

CVE-2026-41720 is a high-severity vulnerability in Spring LDAP's DirContextAuthenticationStrategy implementations. The vulnerability occurs when a non-empty username is paired with an empty or null password, allowing an authentication bypass. Affected versions include Spring LDAP 2.4.0 through 2.4.4, 3.2.0 through 3.2.17, 3.3.0 through 3.3.7, and 4.0.0 through 4.0.3.

MEDIUM Spring CVE published 2026-06-09

CVE-2026-41715

CVE-2026-41715 is a medium-severity vulnerability (CVSS Score: 6.1) affecting Reactor Netty's HTTP client. In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. This can occur only when the HTTP client has been explicitly configured to follow redirects. Affected versions include Reactor Netty 1.0.0 through 1.0.51, 1.1.0 th [truncated]

MEDIUM Spring CVE published 2026-06-09

CVE-2026-41710

CVE-2026-41710 is a medium-severity vulnerability affecting Spring Retry versions 2.0.0 through 2.0.12 and 1.3.0 through 1.3.4. An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the [truncated]

HIGH Spring CVE published 2026-06-09

CVE-2026-41007

CVE-2026-41007 is a high-severity vulnerability in Spring HATEOAS, a library for building RESTful web services. The vulnerability allows for a denial-of-service (DoS) attack due to an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings.

HIGH Spring CVE published 2026-06-09

CVE-2026-41006

A high-severity vulnerability, CVE-2026-41006, was found in Spring HATEOAS, affecting versions 1.5.0 through 1.5.6, 2.3.0 through 2.3.4, 2.4.0 through 2.4.1, 2.5.0 through 2.5.2, and 3.0.0 through 3.0.3. The vulnerability is caused by the internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performing bean property binding via reflection [truncated]

HIGH Spring CVE published 2026-06-09

CVE-2026-40984

Micrometer users should assess exposure to denial-of-service (DoS) conditions via specially crafted HTTP requests. Affected versions include micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17 and micrometer-jetty11 and micrometer-jetty12 with similar version ranges. Defenders should verify inventory, review vendor remediation [truncated]

HIGH Spring CVE published 2026-06-09

CVE-2026-40983

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-09T05:16:34.653Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. This denial-of-service vulnerability in Micrometer, tracked as CVE-2026-40983, affects versions 1.16.0 through 1.16.5 and 1.15.0 through 1.15.11. Defenders should assess exposure and prioritize verif [truncated]

MEDIUM Spring CVE published 2026-05-25

CVE-2026-41863

Spring AI versions 1.1.0 through 1.1.x contain a path traversal vulnerability in their Anthropic Skills API integration. The application uses LLM-influenced filenames without sanitization when calling Path.resolve() before writing files to disk, allowing authenticated attackers to write files outside the intended target directory. This could enable writing to restricted system directories, potentially lea [truncated]

HIGH Spring CVE published 2026-05-09

CVE-2026-41705

CVE-2026-41705 affects Spring AI's MilvusVectorStore#doDelete(List) path, where unsanitized document IDs can be used to inject filter expressions. The vendor guidance says Spring AI 1.0.x should be upgraded to 1.0.7 or later, and Spring AI 1.1.x should be upgraded to 1.1.6 or later.

CRITICAL Spring CVE published 2026-05-07

CVE-2026-40982

CVE-2026-40982 is a critical vulnerability in VMware Spring Cloud Config, allowing directory traversal attacks. Affected versions include 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x. Malicious users or attackers can send specially crafted URLs to exploit this vulnerability. Upgrades to 3.1.14, 4.1.10, 4.2.7, 4.3.3, or 5.0.3 are recommended for affected versions. This vulnerability has a CVSS score of 9.1 and is [truncated]

HIGH Spring CVE published 2026-05-07

CVE-2026-40981

CVE-2026-40981 is a high-severity vulnerability in VMware Spring Cloud Config that could allow exposure of secrets from unintended GCP projects when using Google Secrets Manager as a backend. The vulnerability affects multiple versions of Spring Cloud Config, including 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x. To mitigate this vulnerability, users should upgrade to the latest version of Spring Cloud Config. [truncated]

CRITICAL Spring CVE published 2026-04-28

CVE-2026-40976

CVE-2026-40976 is a critical vulnerability in Spring Boot that allows unauthorized access to all endpoints. The vulnerability exists when an application is a servlet-based web application, has no Spring Security configuration of its own, relies on the default web security filter chain, depends on spring-boot-actuator-autoconfigure, and does not depend on spring-boot-health. Affected versions include Sprin [truncated]

MEDIUM Spring CVE published 2026-04-28

CVE-2026-40975

CVE-2026-40975 is a medium-severity vulnerability affecting Spring Boot, a popular Java framework for building web applications. The issue arises from the insecure generation of random numbers, which can be used as secrets. Specifically, the ${random.value} function produces values that are not suitable for use as secrets. Additionally, ${random.int} and ${random.long} should not be used for secrets due t [truncated]

HIGH Spring CVE published 2026-04-28

CVE-2026-40973

A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `true` and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user. The vulnerabilit [truncated]

HIGH Spring CVE published 2026-04-28

CVE-2026-40972

CVE-2026-40972 is a high-severity vulnerability in VMware Spring Boot that allows an attacker to discover the remote secret via a timing attack, potentially leading to remote code execution. The vulnerability affects multiple versions of Spring Boot, including 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, and 2.7.0-2.7.32. This vulnerability is caused by a timing attack vulnerability in the DevTo [truncated]