CVE-2026-59303 is a low severity vulnerability in Spring Cloud Stream where the dynamic destination cache size is not properly bounded. This issue affects multiple versions of Spring Cloud Stream, including 4.2.0 through 4.2.6, 4.3.0 through 4.3.3, and 5.0.0 through 5.0.2. The flaw relates to allocation of resources without limits or throttling (CWE-770), potentially leading to resource exhaustion. No official patch or remediation guidance is currently available.
CVE-2026-59302 is a low severity vulnerability in Spring Cloud Stream where sensitive information may be inserted into log files. It affects multiple versions of Spring Cloud Stream including 4.2.0 through 4.2.6, 4.3.0 through 4.3.3, and 5.0.0 through 5.0.2. The vulnerability involves potential exposure of sensitive data through logging, classified under CWE-532. No official patch or remediation guidance is currently available.
CVE-2026-59301 is a low-severity vulnerability in Spring Cloud Function that involves the potential insertion of sensitive information into log files. It affects specific versions of Spring Cloud Function, including 4.2.0 through 4.2.7, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.3. The vulnerability relates to CWE-532, which concerns the improper logging of sensitive data. The affected product is a cloud service, and the vendor manages remediation for this type of service. No known exploits are reported in the wild.
CVE-2026-59300 is a low severity vulnerability in Spring Cloud Function that involves the potential insertion of sensitive information into log files. It affects multiple versions of Spring Cloud Function, including 3.2.16 and earlier, 4.2.0 through 4.2.7, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.3. The vulnerability relates to logging sensitive data in the AWS environment. A patch is available, and since this is a cloud service, the vendor typically manages remediation server-side.
CVE-2026-59299 is a low severity vulnerability in Spring Cloud Function affecting versions 3.2.16 and earlier, 4.2.0 through 4.2.7, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.3. It involves a potential modification of assumed-immutable data (CWE-471) where composition lookup can poison the base function. The vulnerability has a CVSS score of 3.1, indicating low impact on confidentiality and integrity, with no impact on availability.
Potential for improper filtering of HTTP headers in Spring Cloud Function.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Function 4.2.0 - 4.2.7
Spring Cloud Function 3.2.16 and earlier
CVE-2026-59297 is a low severity vulnerability in Spring Cloud Function affecting versions 4.2.0 through 4.2.7, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.3. The issue arises because the isSecure() method in ServerlessHttpServletRequest does not properly verify the actual scheme, leading to an origin validation error classified as CWE-346. This could potentially allow incorrect assumptions about the security of a connection.
CVE-2026-59294 is a path traversal vulnerability in Spring AI affecting versions 1.0.9 and earlier, 1.1.0 through 1.1.8, and 2.0.0. The vulnerability arises because ResourceCacheService.getCacheName() constructs file paths by appending URI fragments without sanitizing path separators or '..' sequences, allowing potentially unauthorized file writes. The CVSS 3.1 score is 5.9 (medium severity). No official patch or remediation guidance is currently available.
CVE-2026-59293 is a medium severity vulnerability in Spring Integration where the jCIFS client may negotiate down to the less secure SMB1/CIFS protocol if the application does not explicitly set smbMinVersion. SMB1 lacks mandatory signing and encryption, making it vulnerable to NTLM relay attacks and content tampering via man-in-the-middle. This affects specific versions of Spring Integration including 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and exactly 7.1.0. No official patch or remediation guidance is currently documented.
CVE-2026-59292 is a low severity vulnerability in Spring Integration where the default file-based ConcurrentMetadataStore persists its state to a file with world-readable permissions. This incorrect permission assignment could expose sensitive metadata to unauthorized local users. The issue affects multiple versions of Spring Integration including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. No official patch or remediation guidance has been provided yet.
CVE-2026-59291 is a low severity vulnerability in Spring Cloud Function that involves a potential server-side request forgery (SSRF) and arbitrary file read. It affects specific versions of Spring Cloud Function including 4.2.0 through 4.2.7, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.3. The vulnerability has a CVSS score of 2.0, indicating low impact. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service.
Spring for GraphQL 2.0.0 - 2.0.4
Spring for GraphQL 1.4.0 - 1.4.6
Spring for GraphQL 1.2.0 - 1.3.9
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website.
Spring for GraphQL 2.0.0 - 2.0.4
Spring for GraphQL 1.4.0 - 1.4.6
Spring for GraphQL 1.1.0 - 1.3.9
Spring for GraphQL 1.0.0 - 1.0.7
Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled.
Spring for GraphQL 2.0.0 - 2.0.4
Spring for GraphQL 1.4.0 - 1.4.6
Spring for GraphQL 1.3.0 - 1.3.9
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page.
Spring for GraphQL 2.0.0 - 2.0.4
Spring for GraphQL 1.4.0 - 1.4.6
Spring for GraphQL 1.1.0 - 1.3.9
Spring for GraphQL 1.0.0 - 1.0.7
CVE-2026-59284 is a medium severity vulnerability in Spring Cloud Commons affecting versions 3.1.10 and earlier through 5.0.2. It involves the lack of an allow list for property keys when the writable /actuator/env endpoint is enabled, potentially allowing improper modification of dynamically-determined object attributes. The vulnerability is classified under CWE-915. No official patch or remediation guidance is currently confirmed.
CVE-2026-59277 is a low-severity vulnerability in Spring Security 7.1.0 involving the InetAddressMatchers utility. This utility provides builders to classify IP addresses as internal or external networks. The issue relates to a protection mechanism failure (CWE-693) in this classification functionality.
CVE-2026-59276 is a timing discrepancy vulnerability in Spring Security where security-sensitive string comparisons use standard equality checks instead of constant-time comparisons. This causes the time taken to reject incorrect values to vary based on the number of matching leading characters. The vulnerability affects multiple versions of Spring Security including 5.7.0 through 7.1.0. The CVSS score is 5.9, indicating medium severity.
A path traversal vulnerability (CWE-22) exists in Spring Framework's FreeMarker integration when a controller returns a view name derived from untrusted input and FreeMarker resolves templates via SpringTemplateLoader. This affects multiple Spring Framework versions from 5.2.25.RELEASE and earlier up to 7.0.8. The vulnerability allows an attacker with low privileges to read files outside the intended directory. The CVSS score is 4.3 (medium severity). No known exploits are reported in the wild, and no official patch information is provided in the input data.