CVE-2026-47879 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in Spring Cloud Gateway's JsonToGrpcGatewayFilterFactory. It allows attackers with high privileges to specify arbitrary Spring Resource locations for proto descriptor definitions, potentially leading to complete confidentiality and integrity compromise. The vulnerability affects multiple versions of Spring Cloud Gateway up to 5.0.2 and earlier. No official patch or remediation guidance is currently available.
CVE-2026-47878 is a medium severity vulnerability in Spring Batch affecting versions 5.2.6 and earlier, and 6.0.0 through 6.0.4. It involves unsafe deserialization where the DefaultExecutionContextSerializer passes Base64-decoded data directly to ObjectInputStream.readObject() without applying an ObjectInputFilter to restrict deserialized types to a trusted allowlist. This can lead to potential integrity, confidentiality, and availability impacts.
CVE-2026-47877 is a high severity cross-site scripting (XSS) vulnerability in Spring Security Authorization Server's default consent page. The issue arises because user-controlled values are rendered without proper HTML entity encoding, allowing potential injection of malicious scripts. This affects Spring Security versions 7.0.0 through 7.0.6 and version 7.1.0. The vulnerability requires user interaction and can lead to partial confidentiality impact but no availability impact. No official patch or remediation guidance is currently confirmed.
CVE-2026-47875 is a medium severity vulnerability in Spring Batch affecting versions 5.2.0 through 5.2.6 and 6.0.0 through 6.0.4. It involves unsafe deserialization of untrusted data when using Jackson2ExecutionContextStringSerializer, allowing attackers to bypass trusted-types allowlist enforcement in JobParameterDeserializer. This can lead to arbitrary code execution via known Jackson RCE gadgets.
CVE-2026-47864 is a deserialization vulnerability in Spring Integration's SerializingHttpMessageConverter. It deserializes HTTP request bodies with a raw ObjectInputStream without class filtering, allowing remote unauthenticated attackers to execute arbitrary code if a suitable Java deserialization gadget is present on the classpath. The vulnerability affects multiple versions of Spring Integration including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The CVSS score is 6.4 (medium severity). No official patch or remediation guidance is currently provided.
CVE-2026-47849 is a high severity vulnerability in Spring Data REST that allows mutation of identifier (@Id) and version (@Version) properties via JSON Patch requests. This improper control of dynamically-determined object attributes can lead to integrity issues. The vulnerability affects multiple versions of Spring Data REST including 3.7.20 and earlier, 4.0.0 through 4.4.15, 4.5.0 through 4.5.12, 5.0.0 through 5.0.6, and 5.1.0. There is no confirmed patch or official remediation available at this time.
CVE-2026-47874 is a medium severity vulnerability in Spring Reactor Netty where HTTP/1.1 pipelined requests over a single connection can cause excessive memory consumption. This affects multiple versions of Reactor Netty, including 1.0.52 and earlier, 1.1.0 through 1.2.18, and 1.3.0 through 1.3.6. The issue is related to allocation of resources without limits or throttling (CWE-770). No official patch or remediation guidance is currently provided.
CVE-2026-47861 is a server-side request forgery (SSRF) vulnerability in Spring Integration's UDP inbound adapter. An unauthenticated remote attacker can send a single UDP packet to trigger the server to send an outbound UDP datagram to an arbitrary host and port chosen by the attacker. This affects multiple versions of Spring Integration including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The vulnerability has a CVSS score of 6.3, indicating a medium severity level. No official patch or remediation information is currently available.
CVE-2026-47863 is a medium severity vulnerability in Spring Reactor Core affecting versions 3.7.19 and earlier through 3.8.6. It involves an infinite loop condition triggered when using the Flux.bufferTimeout operator with fairBackpressure enabled, leading to a denial of service (DoS). No official patch or remediation guidance is currently available.
CVE-2026-47862 is a path traversal vulnerability in Spring Integration affecting certain versions. An attacker who can control the file_name header on a message processed by the ZipTransformer component with the default ZipResultType.FILE can cause a .zip archive to be written outside the intended working directory. This could lead to unauthorized file writes on the filesystem. The vulnerability affects specific versions of Spring Integration including 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and exactly version 7.1.0. The CVSS score is 5.4, indicating a medium severity impact. No official patch or remediation information is currently available.
CVE-2026-47860 is a medium severity vulnerability in Spring AMQP involving improper handling of highly compressed data, also known as a decompression bomb. An attacker able to publish to a queue consumed by an application with message decompression enabled can crash the consumer JVM by sending a single approximately 1 MB message. This affects certain versions of Spring AMQP including 4.1.0, 4.0.0 to 4.0.4, 3.2.0 to 3.2.12, and 2.4.18 and earlier. There is no confirmed patch or official remediation available at this time.
CVE-2026-47859 is a medium severity vulnerability in Spring Integration's syslog TCP inbound adapter. The RFC6587SyslogDeserializer component trusts the sender-supplied octet count for octet-counted frames and allocates a byte array of that exact size without any upper limit. This can lead to uncontrolled resource allocation. The affected versions include Spring Integration 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. No official patch or remediation guidance is currently available.
CVE-2026-47857 is an integer overflow vulnerability in Spring Reactor Core affecting applications using the Flux.windowTimeout operator with fairBackpressure enabled. This flaw can lead to a Denial of Service (DoS) condition. The vulnerability impacts multiple versions of Reactor Core, including 3.8.0 through 3.8.6, 3.5.0 through 3.7.19, and 3.4.41 and earlier. The CVSS score is 5.9, indicating a medium severity level. No official patch or remediation guidance is currently available.
CVE-2026-47856 is a medium severity vulnerability in Spring Integration affecting multiple versions including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The issue arises from deserialization of untrusted data via the json__TypeId__ header, which is used without a type or package allow-list, allowing arbitrary class resolution. This vulnerability is categorized under CWE-502 (Deserialization of Untrusted Data). No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-47852 is a high-severity vulnerability in Spring AI versions 1.0.0 through 1.0.9, 1.1.0 through 1.1.8, and 2.0.0. It allows a local attacker on a multi-user system to pre-create a deterministic cache path and place a malicious ONNX model file, potentially leading to integrity compromise. The vulnerability is related to insecure handling of temporary files (CWE-377). No official patch or remediation guidance is currently available.
CVE-2026-47851 is a high-severity vulnerability in Spring AI where analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. This uncontrolled recursion issue affects multiple versions of Spring AI, including 1.0.0 through 1.0.9, 1.1.0 through 1.1.8, and version 2.0.0. The vulnerability does not impact confidentiality or integrity but causes a denial of service due to application crash.
CVE-2026-47850 is a medium severity vulnerability in Spring Data REST where the persisted version (@Version) property of an aggregate root is not preserved when handling HTTP PUT requests against immutable target types. This issue affects multiple versions of Spring Data REST including 3.7.20 and earlier, 4.0.0 through 4.4.15, 4.5.0 through 4.5.12, 5.0.0 through 5.0.6, and 5.1.0. The vulnerability relates to improper control of dynamically-determined object attributes, classified under CWE-915. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.
CVE-2026-47845 is an authentication bypass vulnerability in Spring Reactor Netty HTTP Server when configured to use the HAProxy Protocol. The issue arises from incorrect evaluation of the remote IP address in specific scenarios, potentially allowing spoofing. This affects certain versions of Reactor Netty, including 1.0.52 and earlier, 1.1.0 through 1.2.18, and 1.3.0 through 1.3.6. The vulnerability has a medium severity with a CVSS score of 5.3.
CVE-2026-47848 is a medium severity vulnerability in Spring Reactor Netty where the WebSocket client may leak credentials during handshake redirects to a different origin if the HTTP client is configured to follow redirects. This affects specific versions of Reactor Netty. No official patch or remediation guidance is currently confirmed.
CVE-2026-47844 is a medium severity vulnerability in Spring's Reactor Netty HTTP Server where exception details may be leaked across unrelated requests when the server is configured with Brave Tracing. This affects certain versions of Reactor Netty including 1.3.0 to 1.3.6, 1.1.0 to 1.2.18, and 1.0.52 and earlier. The vulnerability is classified under CWE-668, which involves exposure of resources to the wrong sphere. No official patch or remediation guidance has been provided yet.