JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types.
Affected versions:
Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError.
Affected versions:
Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.
Affected versions:
Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.
Affected versions:
Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory.
Affected versions:
Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.
CVE-2026-41007 is a high-severity vulnerability in Spring HATEOAS where an unbounded static cache of StringLinkRelation instances is maintained using attacker-supplied strings. This affects multiple versions from 1.5.0 through 3.0.3. The vulnerability can lead to resource exhaustion due to allocation without limits or throttling.
CVE-2026-41006 is a high severity vulnerability in Spring HATEOAS affecting versions 1.5.0 through 1.5.6, 2.3.0 through 2.3.4, 2.4.0 through 2.4.1, 2.5.0 through 2.5.2, and 3.0.0 through 3.0.3. The issue arises from the internal PropertyUtils.createObjectFromProperties method, which performs bean property binding via reflection without respecting Jackson access-control annotations. This improper access control can lead to denial of service impacts. No official patch or remediation guidance is currently available.
In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Spring Framework versions 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7 are vulnerable to HTTP request smuggling attacks via multipart requests. This vulnerability is identified as CWE-444, involving inconsistent interpretation of HTTP requests. The CVSS score is 5.3, indicating a medium severity level. No official patch or remediation guidance has been provided yet.
CVE-2026-41852 is a vulnerability in the Spring Framework's Spring Expression Language (SpEL) evaluation logic that allows arbitrary zero-argument method invocation even in restricted or read-only contexts. This could enable attackers to invoke unintended application logic. The affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48. The vulnerability has a low severity rating and a CVSS score of 3.7. No official patch or remediation guidance is currently provided.
Applications which accept user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack if the evaluation of a SpEL expression triggers unbounded cache growth.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Spring Framework versions 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7 are affected by an inefficient algorithmic complexity vulnerability in the evaluation of Spring Expression Language (SpEL) expressions. This vulnerability allows an attacker to supply specially crafted expressions that cause excessive resource consumption, potentially leading to denial of service conditions. The vulnerability is identified as CWE-407 and has a CVSS v3.1 score of 7.5, indicating high severity. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-41849 is an integer overflow vulnerability in the Spring Expression Language (SpEL) evaluation logic of the Spring Framework. This flaw allows an attacker to craft a SpEL expression that triggers excessive resource consumption, resulting in a denial of service (DoS). It affects Spring Framework versions 5.3.0 through 5.3.48. The vulnerability has a high severity score of 7.5. Currently, no official patch or remediation guidance is available from the vendor.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Spring Framework's AntPathMatcher component. This affects versions 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48. The vulnerability arises when an attacker can supply a crafted pattern to certain AntPathMatcher methods, potentially causing inefficient regular expression processing and denial of service. The CVSS score is 3.7, indicating low severity. No official patch or remediation guidance is currently available.
CVE-2026-41847 is a medium severity vulnerability in the Spring Framework's WebFlux Kotlin Router DSL that allows improper access control, potentially enabling security bypass. It affects Spring Framework versions from 5.3.0 through 5.3.48. There is currently no official patch or remediation guidance from the vendor. No known exploits are reported in the wild at this time.
A cross-site scripting (XSS) vulnerability exists in Spring Framework's MVC component where user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags are not properly neutralized. This allows injection of arbitrary HTML or JavaScript code. The vulnerability affects multiple versions of Spring Framework including 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. The CVSS score is 5.9, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor.
A cross-site scripting (XSS) vulnerability exists in the Spring Framework due to improper escaping in the JavaScriptUtils.javaScriptEscape() method. This flaw affects multiple versions of the Spring Framework, including 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. The vulnerability could allow an attacker to inject JavaScript code into the browser, potentially leading to information disclosure. The CVSS score is 7.1, indicating a high severity level. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.
CVE-2026-41844 is an open redirect vulnerability in the Spring Framework affecting Spring MVC or Spring WebFlux applications that configure a catch-all mapping ("/**") without explicitly specifying the view name. This allows attackers to craft URLs that cause a 302 redirect to arbitrary external hosts using the redirect: prefix. The vulnerability affects multiple Spring Framework versions from 5.3.0 through 7.0.7. The CVSS score is 4.2, indicating medium severity.
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.