CVE-2026-59272 is a vulnerability in Spring AMQP affecting versions 2.4.18 and earlier, 3.2.0 through 3.2.12, 4.0.0 through 4.0.4, and 4.1.0. It involves improper validation of TLS certificates with host mismatches when applications send logs to RabbitMQ over TLS using the Log4j2 appender with default settings. This flaw can allow man-in-the-middle interception of log events.
CVE-2026-47893 is a high severity vulnerability in the Spring Framework affecting multiple versions. It involves the generation of error messages in Spring WebFlux applications that support WebSocket connections, where request headers may be included in exception reasons, potentially exposing sensitive user information. The vulnerability affects versions from 5.2.25.RELEASE and earlier up to 7.0.8. There is no explicit vendor advisory or patch information available at this time.
CVE-2026-47892 is a critical authorization vulnerability in the Spring Framework affecting multiple versions from 5.2.5.RELEASE through 7.0.8. It allows bypass of header predicate checks in pre-flight requests when using WebFlux functional endpoints with DispatcherServlet, potentially compromising confidentiality, integrity, and availability of affected applications.
CVE-2026-47891 is a critical vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE and earlier through 7.0.8. It involves the Spring WebFlux application using the Aalto XML processor, which fails to properly enforce the maxInMemorySize limit. This can lead to uncontrolled resource allocation during XML parsing, potentially causing denial of service or other impacts.
CVE-2026-47890 is a critical vulnerability in the Spring Framework affecting versions 6.2.0 through 6.2.19 and 7.0.0 through 7.0.8. It involves improper neutralization of CRLF sequences (CRLF Injection) that can cause stream corruption when using Server-Sent Events (SSE) with view fragments in Spring MVC and WebFlux applications. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-47889 is a high-severity vulnerability in the Spring Framework versions 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19. It affects WebFlux applications running on the Jetty 12 Core reactive adapter, where response cookies are serialized without the SameSite attribute. This omission can cause sensitive cookies to be sent in cross-site requests, increasing the risk of cross-site request forgery (CSRF) attacks. No official patch or remediation guidance is currently available.
CVE-2026-47888 is a high severity vulnerability in the Spring Framework that causes a memory leak when a malformed SETUP frame is processed by a Spring RSocket application. It affects multiple versions of the Spring Framework from 5.2.0.RELEASE through 7.0.8. The vulnerability is classified as CWE-401, indicating missing release of memory after its effective lifetime. There is no vendor advisory or patch information available at this time.
CVE-2026-47887 is an open redirect vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE and earlier through 7.0.8. It arises when a Spring MVC application uses UrlFileNameViewController mapped with an end-of-path and lacks a configured prefix, allowing redirection to untrusted sites. The vulnerability has a medium severity with a CVSS score of 6.1.
A denial of service (DoS) vulnerability exists in Spring Framework versions 5.2.25.RELEASE and earlier through 7.0.8, where user-supplied Spring Expression Language (SpEL) expressions using the power operator (^) with BigDecimal or BigInteger operands and large exponents can cause uncontrolled resource consumption.
CVE-2026-47885 is a high-severity vulnerability in the Spring Framework's WebFlux module affecting versions 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. The issue arises because the PartEventHttpMessageReader does not enforce the maxPartSize limit when maxInMemorySize is set to -1, leading to allocation of resources without limits or throttling. This flaw could potentially allow resource exhaustion attacks. No official patch or remediation guidance has been confirmed yet.
CVE-2026-47884 is a critical path traversal vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE and earlier through 7.0.8. It arises from improper limitation of pathnames in the XsltView component of Spring MVC. Applications with a /** mapping that triggers view rendering without an explicitly specified view name are vulnerable. This flaw can lead to server-side request forgery (SSRF) and remote code execution (RCE). The vulnerability has a CVSS score of 9.8, indicating critical severity. No official patch or remediation guidance is currently available.
CVE-2026-47883 is an open redirect vulnerability in the UrlHandlerFilter component of the Spring Framework, affecting Spring MVC and Spring WebFlux. It arises when the filter is configured with broadly matching patterns, enabling redirection to untrusted sites. This vulnerability affects Spring Framework versions 6.2.0 through 6.2.19 and 7.0.0 through 7.0.8. The CVSS score of 6.1 indicates medium severity.
CVE-2026-59278 is a Server-Side Request Forgery (SSRF) vulnerability in Spring for Apache Kafka. The issue arises because JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. This default configuration allows an external Kafka producer to inject a java.net.InetAddress type via the spring_json_header_types message header. The vulnerability affects multiple versions of Spring for Apache Kafka, including 4.1.0, 4.0.0 through 4.0.6, 3.0.0 through 3.3.16, 2.9.0 through 2.9.14, and 2.8.12 and earlier. The CVSS score is 6.5, indicating a medium severity level.
CVE-2026-59275 is a deserialization vulnerability in Spring AMQP that allows a single malicious AMQP message to cause the entire consumer JVM to terminate via System.exit(99), resulting in complete availability loss for all workloads running in that process. It affects multiple versions of Spring AMQP, including 4.1.0, 4.0.0 through 4.0.4, 3.2.0 through 3.2.12, and 2.4.18 and earlier. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data).
CVE-2026-59274 is a medium severity vulnerability in Spring Integration's UnZipTransformer component. The vulnerability arises because the component does not limit the decompressed size or number of entries when processing zip archives. An attacker can exploit this by sending a specially crafted zip archive that exhausts JVM heap memory, resulting in a denial-of-service (DoS) condition. This affects specific versions of Spring Integration including 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and exactly 7.1.0. No official patch or remediation guidance is currently provided. No known exploits are reported in the wild.
CVE-2026-59271 is a vulnerability in Spring AMQP where the RabbitMQ management aliveness check failure causes the configured admin password to be exposed in cleartext within the exception message. This affects multiple versions of Spring AMQP including 2.4.18 and earlier, 3.2.0 through 3.2.12, 4.0.0 through 4.0.4, and exactly 4.1.0. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently provided.
CVE-2026-59270 is a critical vulnerability in Spring Security involving the embedded UnboundID LDAP server (UnboundIdContainer). It unconditionally registers an administrative credential and binds its listener to all network interfaces, potentially allowing unauthorized access. This affects multiple versions of Spring Security including 5.7.0, 5.8.0, 6.4.0, 6.5.0, 7.0.0, and 7.1.0. The vulnerability has a high CVSS score of 9.4, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-47894 is a path traversal vulnerability in Spring Cloud Config Server's native environment repository that allows exposure of configuration files outside the intended repository path. It affects multiple versions of Spring Cloud Config, including 3.1.14 and earlier, 4.0.0 through 4.2.8, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.4. The vulnerability has a medium severity with a CVSS score of 4.9 and does not have an official patch or remediation guidance published yet.
CVE-2026-47881 is a medium severity vulnerability in Spring Batch's FlatFileItemReader component. It involves uncontrolled resource consumption when processing specially crafted input files with multi-line logical records. This can cause excessive CPU and memory usage, potentially stalling batch jobs or causing out-of-memory conditions. The issue affects multiple versions of Spring Batch including 4.3.0 through 4.3.13, 5.2.0 through 5.2.6, and 6.0.0 through 6.0.4.
CVE-2026-47880 is a medium severity vulnerability in Spring Integration affecting multiple versions including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. It involves improper input validation where a JMS message producer can set certain JMS String properties (replyChannel, errorChannel, json__TypeId__) that are copied directly into Spring Integration MessageHeaders without validation.