SB20260828166 - Multiple vulnerabilities in Spring Framework

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260828166

SB20260828166 - Multiple vulnerabilities in Spring Framework

Published: August 28, 2026 Updated: August 31, 2026

Security Bulletin ID SB20260828166
CSH Severity
High
Patch available
YES
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 6% Medium 65% Low 29%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 vulnerabilities.


1) Information Exposure Through an Error Message (CVE-ID: CVE-2026-47893)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into error messages in HandshakeWebSocketService when handling WebSocket handshake requests. A remote attacker can send a request that triggers an exception to disclose sensitive information.


2) CRLF injection (CVE-ID: CVE-2026-59313)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to corrupt the stream of data sent to other users.

The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in server-sent event handling in Spring MVC functional web framework when streaming plain text server-sent event messages containing attacker-controlled data. A remote user can provide crafted data that will be streamed to other users to corrupt the stream of data sent to other users.

User interaction is required, and the issue applies only when applications use Spring MVC functional web framework with RouterFunction and ServerResponse.sse() to send plain text rather than a structured format such as JSON.


3) HTTP response splitting (CVE-ID: CVE-2026-59314)

CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt HTTP headers or multipart body framing.

The vulnerability exists due to improper neutralization of carriage return and line feed sequences in Content-Disposition header handling when processing untrusted file names. A remote attacker can supply a malicious file name to corrupt HTTP headers or multipart body framing.

User interaction is required to trigger exploitation. The issue affects applications that set Content-Disposition values from untrusted input, including use in outbound multipart request parts, and the header-splitting case applies to non-default or legacy connectors that do not reject malicious header characters.


4) Improper Control of Dynamically-Managed Code Resources (CVE-ID: CVE-2026-59283)

CWE-ID: CWE-913 - Improper Control of Dynamically-Managed Code Resources

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to improper control of dynamically-managed code resources in Spring Expression Language (SpEL) expression evaluation when evaluating expressions using SimpleEvaluationContext with the SpEL expression compiler active. A remote attacker can supply specially crafted expressions to disclose sensitive information and cause a denial of service.

The issue occurs only when expressions are evaluated with SimpleEvaluationContext and expression compilation is enabled through compiler mode settings such as IMMEDIATE or MIXED.


5) Path traversal (CVE-ID: CVE-2026-59280)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in SpringTemplateLoader when resolving a view name derived from untrusted input. A remote attacker can supply a crafted view name containing backslash sequences to disclose sensitive information.

Only applications that return a view name derived from untrusted input and use FreeMarker configured with SpringTemplateLoader are vulnerable.


6) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59282)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Spring data binding infrastructure when applying user-supplied property paths onto a target object. A remote attacker can supply a property path with an arbitrarily large index into a nested sub-property to cause a denial of service.

Exploitation requires the target object to contain a self-populating list implementation as a property, and the list element type must expose sub-properties.


7) Cross-site scripting (CVE-ID: CVE-2026-59281)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to inject arbitrary html/javascript code.

The vulnerability exists due to cross-site scripting in Errors.getFieldErrors() and Errors.getFieldError() accessors when rendering field errors from a data-binding Errors instance with HTML escaping enabled. A remote attacker can supply crafted input that is later rendered in field errors to inject arbitrary html/javascript code.

The issue can lead to reflected cross-site scripting in Spring MVC and WebFlux applications.


8) Incorrect authorization (CVE-ID: CVE-2026-47892)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass header-based access restrictions.

The vulnerability exists due to improper access control in WebFlux functional endpoints when processing pre-flight requests with DispatcherServlet. A remote attacker can send a specially crafted pre-flight request to bypass header-based access restrictions.

Only WebFlux applications using functional endpoints and deployed with DispatcherServlet are affected.


9) Sensitive cookie with improper SameSite attribute (CVE-ID: CVE-2026-47889)

CWE-ID: CWE-1275 - Sensitive Cookie with Improper SameSite Attribute

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass sameSite cookie restrictions.

The vulnerability exists due to improper cookie attribute handling in JettyCoreServerHttpResponse when serializing response cookies. A remote attacker can cause an application to issue cookies without the sameSite attribute to bypass sameSite cookie restrictions.

Only WebFlux applications running on the Jetty 12 Core reactive adapter are vulnerable.


10) Path traversal (CVE-ID: CVE-2026-47884)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper path limitation in XsltView when rendering views through a catch-all "/**" mapping without an explicitly specified view name. A remote attacker can send a specially crafted request to execute arbitrary code.

The issue can also lead to server-side request forgery.


11) CRLF injection (CVE-ID: CVE-2026-47890)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to corrupt the stream of data sent to other users.

The vulnerability exists due to improper neutralization of carriage return line feeds in server-sent event view fragment rendering when streaming attacker-controlled data to clients over server-sent events. A remote user can control data that is streamed to other users to corrupt the stream of data sent to other users.

Exploitation requires the application to use Spring MVC or Spring WebFlux and send view fragments to clients over server-sent events.


12) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-47891)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Jaxb2Decoder when parsing XML input with the Aalto XML processor. A remote attacker can send specially crafted XML content to cause a denial of service.

The issue affects Spring WebFlux applications that rely on the Aalto XML processor for XML parsing.


13) Open redirect (CVE-ID: CVE-2026-47883)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect users to an arbitrary URL.

The vulnerability exists due to an open redirect in UrlHandlerFilter when processing requests with very broadly matching patterns. A remote attacker can craft a request that triggers a redirect to an arbitrary URL to redirect users to an arbitrary URL.

The issue applies to the filter variants in both Spring MVC and Spring WebFlux.


14) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-47885)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper control of resource consumption in PartEventHttpMessageReader when processing multipart request bodies with maxInMemorySize set to -1. A remote attacker can send a specially crafted multipart request to cause a denial of service.

The issue affects controller methods that use an @RequestBody Flux<PartEvent> argument.


15) Memory leak (CVE-ID: CVE-2026-47888)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in RSocketMessageHandler when processing a malformed SETUP frame. A remote attacker can send a specially crafted SETUP frame to cause a denial of service.


16) Open redirect (CVE-ID: CVE-2026-47887)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect users to an arbitrary URL.

The vulnerability exists due to an open redirect in UrlFileNameViewController when processing requests in applications where it is mapped with an end-of-path and no prefix is configured. A remote attacker can send a specially crafted request to redirect users to an arbitrary URL.


17) Resource exhaustion (CVE-ID: CVE-2026-47886)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Spring Expression Language (SpEL) expression evaluation when processing user-supplied expressions that use the power operator with a BigDecimal or BigInteger operand and a large exponent value. A remote attacker can submit a specially crafted expression to cause a denial of service.

Exploitation requires that the application accept and evaluate untrusted SpEL expressions and that a BigDecimal or BigInteger value be accessible within the evaluation context.


Remediation

Install update from vendor's website.

References