CVE-2026-47843 is a low-severity vulnerability in Spring Reactor Netty where, under certain conditions involving multiple clients with different DNS resolver configurations, the system may incorrectly reuse a previously configured DNS resolver. This affects specific versions of Reactor Netty including 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and 1.0.52 and earlier. The vulnerability is classified under CWE-706, indicating the use of an incorrectly-resolved name or reference. No official patch or remediation guidance has been provided yet.
CVE-2026-47842 is a vulnerability in Spring Security where applications using AesBytesEncryptor with certain constructors or null IV generators and CBC mode encrypt data with AES/CBC using a null (all-zero) initialization vector. This affects multiple versions of Spring Security including 5.7.0 through 7.1.0. The vulnerability has a CVSS score of 6.5, indicating medium severity. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-47834 is a medium severity vulnerability in Spring Data JPA involving improper neutralization of special elements in SQL commands, specifically an SQL injection risk. The issue arises because the Sort validation can be bypassed when parameters containing crafted payloads are accepted from untrusted sources. This affects multiple versions of Spring Data JPA including 3.0.0 through 3.4.15, 3.5.0 through 3.5.13, 4.0.0 through 4.0.6, and exactly 4.1.0. The vulnerability has a CVSS score of 4.8 and does not currently have an official patch or remediation level indicated. No known exploits in the wild have been reported.
CVE-2026-47841 is a high severity vulnerability in Spring Security's WebAuthn support that may allow user verification bypass when using a distributed HTTP session store. It affects multiple versions of Spring Security including 6.4.x, 6.5.x, 7.0.x, and 7.1.0. The vulnerability relates to improper authentication (CWE-287). No official patch or remediation guidance is currently confirmed.
CVE-2026-47837 is a vulnerability in Spring Cloud Config where the /monitor endpoint does not validate webhook requests, resulting in missing authentication for a critical function. This affects multiple versions of Spring Cloud Config from 3.1.14 through 5.0.4. The vulnerability has a CVSS score of 6.8, indicating medium severity, and can cause availability impact. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-47836 is a high-severity time-of-check time-of-use (TOCTOU) race condition vulnerability in Spring Cloud Config Server. It affects the base directory used to clone SVN repositories, potentially allowing an attacker to exploit the timing window between checking and using the directory path. The vulnerability impacts multiple versions of Spring Cloud Config, including 3.1.14 and earlier, 4.0.0 through 4.2.8, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.4. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-41707 is an authentication bypass vulnerability in Spring Security's DPoPProofJwtDecoderFactory. The issue arises from a cache-based replay attack where the internal cache for JWT ID claims has a strict size limit. Attackers can flood the cache with dummy requests to evict legitimate entries and then replay intercepted valid DPoP proofs to bypass authentication. This affects Spring Security versions 7.1.0, 7.0.0 through 7.0.6, and 6.5.0 through 6.5.11. The vulnerability has a high severity with a CVSS score of 7.4. No official patch or remediation guidance is currently provided.
CVE-2026-59295 is a medium severity vulnerability in Spring Micrometer where outbound HTTP requests using a Micrometer-instrumented client can cause a denial-of-service condition due to an unbounded memory leak. This issue affects multiple versions of Micrometer including 1.17.0, 1.16.0 through 1.16.6, 1.15.0 through 1.15.12, 1.14.0 through 1.14.16, and all versions up to 1.9.18. The vulnerability is classified under CWE-401, indicating missing release of memory after its effective lifetime. No patch or remediation details are provided in the available data.
CVE-2026-59318 is an authorization vulnerability in Spring AI's tool calling support. The vulnerability arises because the per-request tool list, which is advertised to the model as a boundary, is not fully enforced when dispatching a tool call. This can allow a tool that was not made available to the current request to be invoked, potentially leading to privilege escalation. The issue affects multiple versions of Spring AI, including 1.0.0 through 1.0.9, 1.1.0 through 1.1.8, and version 2.0.0.
CVE-2026-59308 is a medium severity vulnerability in Spring AI version 2.0.0 involving the Semantic Cache feature. The context hash intended to isolate cached responses between different system prompts may allow cached responses to be shared across unrelated contexts, potentially exposing information to the wrong context. The vulnerability has a CVSS score of 4.2, indicating limited confidentiality and integrity impact with no availability impact. No patch or remediation details are provided in the available data.
CVE-2026-59279 is a high-severity vulnerability in Spring AI version 2.0.0 where the MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not limit the number of sessions retained and does not require client authentication by default. This allows a remote attacker to cause the server to accumulate an unlimited number of sessions, leading to memory exhaustion and denial of service for legitimate clients.
CVE-2026-59296 is a medium severity vulnerability in Spring Micrometer involving improper output neutralization for logs (CWE-117). It arises from using untrusted, non-normalized input directly in metrics data such as metric names, tag keys, or tag values. This can lead to injection issues affecting the integrity of logs or monitoring data. The affected versions include Micrometer 1.17.0, 1.16.0 through 1.16.6, 1.15.0 through 1.15.12, 1.14.0 through 1.14.16, and 1.9.18 and earlier. No known exploits are reported in the wild, and no official patch or remediation details are provided in the input data.
CVE-2026-59323 is a medium severity vulnerability in Spring Micrometer Tracing that allows denial of service (DoS) due to unbounded resource allocation when processing incoming baggage headers with W3C baggage propagation in the Brave bridge. This affects multiple versions including 1.7.0, 1.6.0 through 1.6.6, 1.5.0 through 1.5.12, and versions up to 1.4.13. The flaw is related to allocation of resources without limits or throttling, potentially causing service disruption.
CVE-2026-59326 is a low-severity vulnerability in Spring Tools for Eclipse (version 5.2.0 and earlier) where the Spring Boot language server logs the raw value of proxy environment variables, including embedded Basic-auth credentials, at INFO level without redaction. This can lead to unintended disclosure of proxy credentials through log files, which may be accessible to other local users or attached to bug reports.
CVE-2026-59328 is a cross-site scripting (XSS) vulnerability in Spring Tools for Eclipse up to version 5.2.0. It arises from rendering Spring Boot starter wizard dependency tooltips in an embedded browser with JavaScript enabled, where untrusted Initializr endpoints can inject arbitrary scripts. The impact is limited to UI spoofing within the IDE and outbound network beaconing, without full code execution.
Spring Tools for Eclipse versions 5.2.0 and earlier store the Spring Boot DevTools remote secret in cleartext within launch configuration files. These files are saved as XML in the workspace metadata or project directories, potentially exposing the secret if accessed via filesystem, backups, or version control. The secret protects the remote restart/reload endpoint, which can execute arbitrary class bytes on the target application. Exposure of this secret could allow an attacker with read access to achieve remote code execution. The vulnerability has a medium severity with a CVSS score of 4.4.
When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness.
Affected Spring Products and Versions:
Spring Tools for Eclipse: 5.2.0 and earlier
The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback.
Affected Spring Products and Versions:
Spring Tools for Eclipse: 5.2.0 and earlier
Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution.
Affected Spring Products and Versions:
Spring Tools for Eclipse: 5.2.0 and earlier
Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier
Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server.
This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.