SB20260828154 - Multiple vulnerabilities in Spring Framework

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260828154

SB20260828154 - Multiple vulnerabilities in Spring Framework

Published: August 28, 2026 Updated: August 31, 2026

Security Bulletin ID SB20260828154
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 18
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 6% Medium 61% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 18 vulnerabilities.


1) Protection mechanism failure (CVE-ID: CVE-2026-41847)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass security-related request handling.

The vulnerability exists due to improper implementation in the WebFlux Kotlin Router DSL when processing requests through a filter that passes a modified or replaced ServerRequest to the next handler function. A remote attacker can send a request to bypass security-related request handling.

The issue occurs only when a filter applies security-related concerns by modifying or replacing the ServerRequest, because the downstream handler receives the original unmodified request instead.


2) Input validation error (CVE-ID: CVE-2026-41854)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to incorrect host parsing in uricomponentsbuilder when parsing and validating an externally provided URL string. A remote attacker can supply a crafted URL string to perform server-side request forgery.

User interaction is required.


3) Deserialization of Untrusted Data (CVE-ID: CVE-2026-41855)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform unauthorized actions.

The vulnerability exists due to unsafe deserialization in org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter when processing messages in an untrusted JMS environment. A remote attacker can send a crafted message to perform unauthorized actions.

Exploitation can lead to arbitrary class instantiation through gadget class deserialization.


4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-41850)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the Spring Expression Language (SpEL) expression evaluator when processing user-supplied SpEL expressions. A remote attacker can send a specially crafted expression to cause a denial of service.

The issue affects applications that accept and evaluate untrusted or user-controlled SpEL expressions.


5) Protection mechanism failure (CVE-ID: CVE-2026-41852)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to invoke unintended application logic.

The vulnerability exists due to improper restriction of operations within the Spring Expression Language evaluation logic in SpEL expression evaluation when evaluating untrusted or user-controlled expressions. A remote attacker can supply a crafted expression to invoke unintended application logic.

Arbitrary zero-argument method invocation is possible even within restricted or read-only contexts.


6) Input validation error (CVE-ID: CVE-2026-41853)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass WAF or proxy checks.

The vulnerability exists due to improper input validation in multipart request handling in Spring MVC and Spring WebFlux when processing multipart requests. A remote attacker can send a malicious multipart request to bypass WAF or proxy checks.

Exploitation requires the application to accept multipart requests and to be protected by a WAF or proxy that parses multipart requests and performs checks based on their content.


7) Resource exhaustion (CVE-ID: CVE-2026-41851)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the SpEL expression cache when evaluating user-supplied SpEL expressions. A remote attacker can submit crafted expressions to cause a denial of service.

Exploitation requires that the application accept and evaluate untrusted SpEL expressions and cache parsed SpEL expressions. A high volume of processing is typically required, often involving millions of evaluations, including with a single expression using dynamic inputs.


8) Integer overflow (CVE-ID: CVE-2026-41849)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the Spring Expression Language (SpEL) evaluation logic when evaluating untrusted or user-controlled SpEL expressions. A remote attacker can supply a specially crafted SpEL expression to cause a denial of service.

Applications are vulnerable only if they accept and evaluate untrusted or user-controlled SpEL expressions.


9) Inefficient regular expression complexity (CVE-ID: CVE-2026-41848)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to regular expression denial of service in AntPathMatcher when processing an attacker-supplied pattern in match, matchStart, or extractUriTemplateVariables. A remote attacker can provide a crafted pattern to cause a denial of service.

The issue is exposed only if attacker-controlled input is directly or indirectly supplied as the pattern argument to the affected methods.


10) Memory leak (CVE-ID: CVE-2026-41840)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory leakage in multipart request processing in Spring WebFlux when processing multipart requests. A remote attacker can send malicious multipart requests to cause a denial of service.

The issue affects applications that implement a web endpoint that receives multipart requests.


11) Cross-site scripting (CVE-ID: CVE-2026-41846)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to inject arbitrary html or javascript code.

The vulnerability exists due to cross-site scripting in JSP <form:*> tags when processing user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes. A remote attacker can supply crafted attribute values to inject arbitrary html or javascript code.

User interaction is required to trigger the injected content.


12) Cross-site scripting (CVE-ID: CVE-2026-41845)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script code in the victim's browser.

The vulnerability exists due to incorrect escaping in JavaScriptUtils.javaScriptEscape() when processing input for JavaScript output. A remote attacker can supply crafted input to execute arbitrary script code in the victim's browser.

User interaction is required to load the affected content in a browser.


13) Path traversal (CVE-ID: CVE-2026-41843)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in static resource resolution in Spring MVC and WebFlux when handling requests for versioned static resources served from the file system. A remote attacker can send malicious requests to disclose sensitive information.

Exploitation requires that versioned resources support is configured and that the attacker knows or can guess metadata information for targeted resources.


14) Open redirect (CVE-ID: CVE-2026-41844)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect users to an arbitrary external host.

The vulnerability exists due to improper control of generation of code in Spring MVC and Spring WebFlux applications when handling requests to a configured "/**" mapping with no explicit view name. A remote attacker can craft a link using the redirect: prefix to redirect users to an arbitrary external host.

User interaction is required to open the crafted link.


15) Session Fixation (CVE-ID: CVE-2026-41839)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and modify data associated with an authenticated user's session.

The vulnerability exists due to improper session management in the WebFlux session handling mechanism when processing requests from a compromised subdomain. A remote attacker can exchange a known session ID for that of an authenticated user to disclose sensitive information and modify data associated with an authenticated user's session.

Exploitation requires user interaction and a compromised subdomain, for example through cross-site scripting.


16) Resource exhaustion (CVE-ID: CVE-2026-41842)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in static resource resolution in Spring MVC and Spring WebFlux when resolving versioned resources served from the file system. A remote attacker can send malicious requests that are slow to resolve to cause a denial of service.

Only applications that serve static resources from the file system and have versioned resources support configured are vulnerable.


17) Improper access control (CVE-ID: CVE-2026-41841)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the static resource cache in Spring MVC and Spring WebFlux when resolving static resources. A remote attacker can request a publicly available resource with the same name as a protected resource to disclose sensitive information.

Exploitation requires several resource handlers using different resource locations, at least one protected resource handler, and a shared cache across these configurations.


18) Generation of Predictable Numbers or Identifiers (CVE-ID: CVE-2026-41838)

CWE-ID: CWE-340 - Generation of Predictable Numbers or Identifiers

CVSSv4: 5.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to the use of predictable session identifiers in the spring-websocket module when establishing WebSocket sessions. A remote user can predict session IDs to disclose sensitive information.

Exploitation may be possible in combination with inadequate authorization rules, and user interaction is required.


Remediation

Install update from vendor's website.

References