CVE-2026-110608 is an authorization bypass vulnerability in BizSpring Shop's OrderController cancel and receive handlers. Authenticated users can manipulate the orderId parameter to act on orders belonging to other members. This allows attackers to cancel pending orders or confirm receipt of shipped orders without the victim's consent, potentially disrupting order fulfillment and stock allocation.
CVE-2026-110607 is a high-severity vulnerability in BizSpring Shop version 0 that allows authenticated buyers to bypass payment verification. By exploiting the PaymentController.testPostPay handler, attackers can mark orders as paid without actual payment. This enables unauthorized acquisition of goods or settling other members' orders fraudulently.
CVE-2026-59314 is a medium-severity vulnerability in the Spring Framework where applications that construct a Content-Disposition HTTP header from untrusted input may be susceptible to HTTP response splitting attacks. This occurs when malicious file names containing CRLF sequences are used. The vulnerability affects multiple versions of Spring Framework from 5.2.25.RELEASE and earlier up to 7.0.8.
CVE-2026-59313 is a critical vulnerability in the Spring Framework affecting versions from 5.3.0 through 7.0.8. It involves improper neutralization of CRLF sequences (CRLF Injection) in Spring MVC applications using the functional web framework, specifically when handling Server-Sent Events (SSE). This flaw can lead to stream corruption and impacts confidentiality, integrity, and availability.
CVE-2026-59283 is a critical vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE and earlier through 7.0.8. It involves improper control of dynamically-managed code resources when evaluating Spring Expression Language (SpEL) expressions using SimpleEvaluationContext with the SpEL expression compiler active. This flaw can bypass safety guards, leading to high impact on integrity and availability of affected systems.
CVE-2026-59282 is a high severity vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE and earlier through 7.0.8. It involves uncontrolled resource consumption due to how Spring's data binding applies user-supplied property paths to target objects, potentially causing Denial of Service (DoS). The vulnerability impacts availability but not confidentiality or integrity. No official patch or remediation guidance is currently confirmed. Users should monitor vendor advisories for updates and apply fixes once available.
CVE-2026-59281 is a reflected cross-site scripting (XSS) vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE through 7.0.8. The issue arises when Spring MVC and WebFlux applications obtain a data-binding Errors instance with HTML escaping enabled and render field errors using certain accessors, allowing injection of arbitrary HTML or JavaScript code.
CVE-2026-59324 is a high-severity race condition vulnerability in Spring Integration affecting multiple versions including 5.5.21 and earlier, 6.4.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The issue occurs when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering fluxFunction that emits raw payloads, causing concurrent requests on the same FluxMessageChannel subscription to incorrectly share reply headers from the most recently consumed upstream message.
CVE-2026-59322 is a medium severity vulnerability in Spring Integration where the EmbeddedHeadersJsonMessageMapper deserializes JSON headers into a Map without sanitizing or filtering untrusted header names by default. This improper input validation can lead to the creation of GenericMessage objects with mutable headers that may be manipulated. The issue affects multiple versions of Spring Integration including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. No official patch or remediation level has been confirmed yet.
CVE-2026-59321 is a medium severity race condition vulnerability in Spring Integration where a single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that are not thread-safe (THREADING=null), concurrent message processing can corrupt internal engine state, potentially causing leakage of one message's payload or headers into another or causing exceptions during script evaluation. This affects multiple versions of Spring Integration including 5.5.21 and earlier, 6.4.x, 6.5.x, 7.0.x, and 7.1.0.
CVE-2026-59320 is a resource management vulnerability in Spring AMQP version 4.1.0. When a container-level ErrorHandler is configured, each message delivery that throws an exception permanently consumes one link credit. After 100 such failing messages (the default initialCredits), the receiver's credit is exhausted, causing the message broker to stop delivering messages and leaving the listener stalled while still appearing to run.
CVE-2026-59319 is a medium severity vulnerability in Spring AI 2.0.0 where the RedisChatMemoryRepository.findByMetadata() method improperly handles user-supplied metadata values. Unlike other methods in the same class, it does not escape special characters in RediSearch queries, allowing injection of RediSearch syntax. This can cause the query to break out of the intended tag clause and match all indexed chat messages across conversations.
CVE-2026-59317 is a medium severity vulnerability in Spring for Apache Kafka where the DeadLetterPublishingRecovererFactory component improperly validates the retry_topic-original-timestamp header from inbound ConsumerRecords. It directly converts the raw header bytes to a BigInteger without length or format validation, potentially leading to issues affecting availability. Multiple versions of Spring for Apache Kafka are affected, including 2.8.12 and earlier through 4.1.0. No official patch or remediation guidance is currently provided.
CVE-2026-59316 is a high-severity cross-site scripting (XSS) vulnerability in Spring Authorization Server's default consent page. The issue arises because user-controlled values are rendered without HTML entity encoding, allowing an attacker to craft a malicious OAuth2 authorization request. This malicious value is stored server-side and later rendered unencoded in the consent page shown to the user. The affected versions include Spring Authorization Server 1.4.0 through 1.4.11 and 1.5.0 through 1.5.8.
CVE-2026-59315 is a medium severity vulnerability in Spring Cloud Config Monitor that allows denial of service via uncontrolled resource consumption triggered by malicious payloads. It affects multiple versions of Spring Cloud Config including 3.1.14 and earlier, 4.0.0 through 4.2.8, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.4. The vulnerability is classified under CWE-400, indicating resource exhaustion issues. No official patch or remediation guidance is currently documented.
CVE-2026-59311 is a vulnerability in Spring Integration affecting certain versions where a local unprivileged user can exploit improper link resolution before file access. By pre-creating a symbolic link at /tmp/ziptransformer before the application starts, the user can redirect the output of Zip/UnZip transformers to a directory of their choosing. This affects specific versions of Spring Integration including 7.1.0, 7.0.0 to 7.0.5, 6.5.0 to 6.5.10, and 6.4.0 to 6.4.12. The vulnerability has a CVSS score of 6.8, indicating medium severity.
CVE-2026-59306 is a low-severity vulnerability in Spring Cloud Stream that involves the potential deserialization of untrusted data. It affects specific versions of Spring Cloud Stream, including 4.2.0 through 4.2.6, 4.3.0 through 4.3.3, and 5.0.0 through 5.0.2. The vulnerability is classified under CWE-502, which concerns unsafe deserialization practices. No official patch or remediation guidance is currently available, and there are no known exploits in the wild.
CVE-2026-59307 is a high severity vulnerability in Spring Integration involving deserialization of untrusted data. The issue arises when an operator attempts to restrict deserialization using JdbcMessageStore.addAllowedPatterns(...) but receives no protection if the store is a Spring-managed bean. This affects multiple versions of Spring Integration including 7.1.0, 7.0.0 to 7.0.5, 6.5.0 to 6.5.10, and 6.4.0 to 6.4.12. The vulnerability is related to CWE-502, which concerns unsafe deserialization. No official patch or remediation guidance is currently provided by the vendor. The CVSS 3.1 score is 8.0, indicating high severity with network attack vector, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.
CVE-2026-59305 is a low severity vulnerability in Spring Cloud Stream versions 4.2.0 through 4.2.6, 4.3.0 through 4.3.3, and 5.0.0 through 5.0.2. It involves an incorrect behavior order where a partition interceptor may be improperly added while sending messages.
CVE-2026-59304 is a type confusion vulnerability in Spring Cloud Stream related to improper caching of the original content type in the Avro component. It affects multiple versions of Spring Cloud Stream including 4.2.0 through 4.2.6, 4.3.0 through 4.3.3, and 5.0.0 through 5.0.2. The vulnerability has a low CVSS score of 3.1, indicating limited impact. No official patch or remediation level has been provided yet, and there are no known exploits in the wild.