The Spring Application Framework, an open-source Java platform framework now maintained by Broadcom, has addressed 91 vulnerabilities in a recent update. Among these, CVE-2026-59270 is critical and affects Spring Security's embedded UnboundID LDAP server, potentially allowing attackers to authenticate and modify in-memory directory entries. Other notable vulnerabilities include CVE-2026-59285, a critical remote code execution issue in Spring for GraphQL, and CVE-2026-59318, a medium-severity privilege escalation vulnerability in Spring AI's tool-calling functionality. The vulnerabilities cover a range of impacts including XSS, information disclosure, remote code execution, denial of service, security bypasses, and unauthorized access. The increase in vulnerabilities this year is attributed to Broadcom's integration of AI in the Spring framework development process. The patches affect numerous Spring projects such as Spring Security, Spring AI, Cloud Config, Data REST, Integration, Reactor Core, Reactor Netty, AMQP, and Batch.

The vulnerabilities include critical and high severity issues that can lead to remote code execution, privilege escalation, unauthorized access, information disclosure, denial of service, and security bypasses. The critical vulnerability in the embedded UnboundID LDAP server could allow attackers to authenticate and modify directory entries in memory. The critical remote code execution flaw in Spring for GraphQL and the privilege escalation in Spring AI increase the risk of compromise. These vulnerabilities affect a broad range of Spring components used in enterprise applications, potentially impacting many deployments.

Broadcom has released updates that patch these 91 vulnerabilities. Users of the Spring Application Framework and its components should promptly review and apply the latest patches to mitigate these security risks. Since this is a self-hosted framework, remediation depends on users applying the updates. There is no indication that no action is required or that the issues are already mitigated without patching. Users should follow official Broadcom Spring advisories for detailed patching instructions.