SB2026090929 - Multiple vulnerabilities in IBM Library Support for Spring
Published: September 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 74 vulnerabilities.
1) Sensitive cookie with improper SameSite attribute (CVE-ID: CVE-2026-47889)
CWE-ID: CWE-1275 - Sensitive Cookie with Improper SameSite Attribute
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass sameSite cookie restrictions.
The vulnerability exists due to improper cookie attribute handling in JettyCoreServerHttpResponse when serializing response cookies. A remote attacker can cause an application to issue cookies without the sameSite attribute to bypass sameSite cookie restrictions.
Only WebFlux applications running on the Jetty 12 Core reactive adapter are vulnerable.
2) HTTP response splitting (CVE-ID: CVE-2026-59314)
CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt HTTP headers or multipart body framing.
The vulnerability exists due to improper neutralization of carriage return and line feed sequences in Content-Disposition header handling when processing untrusted file names. A remote attacker can supply a malicious file name to corrupt HTTP headers or multipart body framing.
User interaction is required to trigger exploitation. The issue affects applications that set Content-Disposition values from untrusted input, including use in outbound multipart request parts, and the header-splitting case applies to non-default or legacy connectors that do not reject malicious header characters.
3) Information Exposure Through an Error Message (CVE-ID: CVE-2026-47893)
CWE-ID: CWE-209 - Information Exposure Through an Error Message
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to insertion of sensitive information into error messages in HandshakeWebSocketService when handling WebSocket handshake requests. A remote attacker can send a request that triggers an exception to disclose sensitive information.
4) Path traversal (CVE-ID: CVE-2026-47884)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper path limitation in XsltView when rendering views through a catch-all "/**" mapping without an explicitly specified view name. A remote attacker can send a specially crafted request to execute arbitrary code.
The issue can also lead to server-side request forgery.
5) Open redirect (CVE-ID: CVE-2026-47883)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect users to an arbitrary URL.
The vulnerability exists due to an open redirect in UrlHandlerFilter when processing requests with very broadly matching patterns. A remote attacker can craft a request that triggers a redirect to an arbitrary URL to redirect users to an arbitrary URL.
The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
6) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-47885)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper control of resource consumption in PartEventHttpMessageReader when processing multipart request bodies with maxInMemorySize set to -1. A remote attacker can send a specially crafted multipart request to cause a denial of service.
The issue affects controller methods that use an @RequestBody Flux<PartEvent> argument.
7) Resource exhaustion (CVE-ID: CVE-2026-47886)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Spring Expression Language (SpEL) expression evaluation when processing user-supplied expressions that use the power operator with a BigDecimal or BigInteger operand and a large exponent value. A remote attacker can submit a specially crafted expression to cause a denial of service.
Exploitation requires that the application accept and evaluate untrusted SpEL expressions and that a BigDecimal or BigInteger value be accessible within the evaluation context.
8) Open redirect (CVE-ID: CVE-2026-47887)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect users to an arbitrary URL.
The vulnerability exists due to an open redirect in UrlFileNameViewController when processing requests in applications where it is mapped with an end-of-path and no prefix is configured. A remote attacker can send a specially crafted request to redirect users to an arbitrary URL.
9) Memory leak (CVE-ID: CVE-2026-47888)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in RSocketMessageHandler when processing a malformed SETUP frame. A remote attacker can send a specially crafted SETUP frame to cause a denial of service.
10) CRLF injection (CVE-ID: CVE-2026-59313)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to corrupt the stream of data sent to other users.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in server-sent event handling in Spring MVC functional web framework when streaming plain text server-sent event messages containing attacker-controlled data. A remote user can provide crafted data that will be streamed to other users to corrupt the stream of data sent to other users.
User interaction is required, and the issue applies only when applications use Spring MVC functional web framework with RouterFunction and ServerResponse.sse() to send plain text rather than a structured format such as JSON.
11) Link following (CVE-ID: CVE-2026-59311)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite files or disclose sensitive information.
The vulnerability exists due to improper handling of a predictable temporary directory symlink in Zip/UnZip transformers when processing archive transformation output on a host where /tmp/ziptransformer can be pre-created as a symlink. A remote user can pre-create /tmp/ziptransformer as a symlink to redirect output files and extracted contents to a directory of their choosing to overwrite files or disclose sensitive information.
The issue is exploitable only by a user on the same host, and exploitation must occur before the application starts.
12) Incorrect authorization (CVE-ID: CVE-2026-47892)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass header-based access restrictions.
The vulnerability exists due to improper access control in WebFlux functional endpoints when processing pre-flight requests with DispatcherServlet. A remote attacker can send a specially crafted pre-flight request to bypass header-based access restrictions.
Only WebFlux applications using functional endpoints and deployed with DispatcherServlet are affected.
13) Path traversal (CVE-ID: CVE-2026-59280)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to path traversal in SpringTemplateLoader when resolving a view name derived from untrusted input. A remote attacker can supply a crafted view name containing backslash sequences to disclose sensitive information.
Only applications that return a view name derived from untrusted input and use FreeMarker configured with SpringTemplateLoader are vulnerable.
14) Cross-site scripting (CVE-ID: CVE-2026-59281)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to inject arbitrary html/javascript code.
The vulnerability exists due to cross-site scripting in Errors.getFieldErrors() and Errors.getFieldError() accessors when rendering field errors from a data-binding Errors instance with HTML escaping enabled. A remote attacker can supply crafted input that is later rendered in field errors to inject arbitrary html/javascript code.
The issue can lead to reflected cross-site scripting in Spring MVC and WebFlux applications.
15) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59282)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Spring data binding infrastructure when applying user-supplied property paths onto a target object. A remote attacker can supply a property path with an arbitrarily large index into a nested sub-property to cause a denial of service.
Exploitation requires the target object to contain a self-populating list implementation as a property, and the list element type must expose sub-properties.
16) Improper Control of Dynamically-Managed Code Resources (CVE-ID: CVE-2026-59283)
CWE-ID: CWE-913 - Improper Control of Dynamically-Managed Code Resources
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.
The vulnerability exists due to improper control of dynamically-managed code resources in Spring Expression Language (SpEL) expression evaluation when evaluating expressions using SimpleEvaluationContext with the SpEL expression compiler active. A remote attacker can supply specially crafted expressions to disclose sensitive information and cause a denial of service.
The issue occurs only when expressions are evaluated with SimpleEvaluationContext and expression compilation is enabled through compiler mode settings such as IMMEDIATE or MIXED.
17) CRLF injection (CVE-ID: CVE-2026-47890)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to corrupt the stream of data sent to other users.
The vulnerability exists due to improper neutralization of carriage return line feeds in server-sent event view fragment rendering when streaming attacker-controlled data to clients over server-sent events. A remote user can control data that is streamed to other users to corrupt the stream of data sent to other users.
Exploitation requires the application to use Spring MVC or Spring WebFlux and send view fragments to clients over server-sent events.
18) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-47891)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Jaxb2Decoder when parsing XML input with the Aalto XML processor. A remote attacker can send specially crafted XML content to cause a denial of service.
The issue affects Spring WebFlux applications that rely on the Aalto XML processor for XML parsing.
19) Path traversal (CVE-ID: CVE-2026-59294)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to write arbitrary files.
The vulnerability exists due to path traversal in ResourceCacheService.getCacheName() when handling model or tokenizer URIs from a less-trusted source. A remote user can supply a URI with a crafted fragment to write arbitrary files.
Exploitation requires an application to pass model or tokenizer URIs from a less-trusted source, such as tenant configuration, an admin UI, or an external catalogue, to TransformersEmbeddingModel.setModelResource() or setTokenizerResource().
20) Improper access control (CVE-ID: CVE-2026-59270)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read or modify entries in the in-memory directory.
The vulnerability exists due to improper access control in UnboundIdContainer when the embedded LDAP server binds its listener to all available network interfaces and registers a well-known administrative bind DN. A remote attacker can authenticate to the LDAP listener using the well-known administrative bind DN to read or modify entries in the in-memory directory.
The application must use UnboundIdContainer, either directly or through Spring Boot auto-configuration, and the LDAP listener port must be reachable from the attacker's network position.
21) Insecure Temporary File (CVE-ID: CVE-2026-47852)
CWE-ID: CWE-377 - Insecure Temporary File
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to tamper with model integrity.
The vulnerability exists due to improper access control in the ONNX model cache directory handling when resolving the deterministic cache path. A remote attacker can pre-create the cache path and plant a malicious ONNX model file to tamper with model integrity.
This issue is exploitable on a multi-user host.
22) Improper access control (CVE-ID: CVE-2026-41707)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain unauthorized access and impersonate the victim.
The vulnerability exists due to improper access control in DPoPProofJwtDecoderFactory when processing DPoP proofs and caching jti claims. A remote attacker can flood the server with dummy requests to evict a legitimate jti from the cache and replay an intercepted valid DPoP proof to gain unauthorized access and impersonate the victim.
Exploitation requires intercepting a legitimate user's valid DPoP proof.
23) Improper Authentication (CVE-ID: CVE-2026-47841)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass user verification during WebAuthn authentication.
The vulnerability exists due to improper comparison of UserVerificationRequirement in Spring Security WebAuthn support when handling serialized and deserialized HTTP session data in a distributed session store. A remote attacker can use an obtained user's authenticator device to complete WebAuthn authentication without satisfying the user verification step to bypass user verification during WebAuthn authentication.
Only applications that use WebAuthn authentication, explicitly configure userVerification = REQUIRED, and use a distributed HTTP session store are vulnerable.
24) Not Using an Unpredictable IV with CBC Mode (CVE-ID: CVE-2026-47842)
CWE-ID: CWE-329 - Not Using an Unpredictable IV with CBC Mode
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to the use of a fixed initialization vector in AesBytesEncryptor when encrypting data with the two-argument constructor or with a null IV generator and CBC mode. A remote user can read encrypted records and compare deterministic ciphertext values to disclose sensitive information.
This issue enables correlation of identical plaintext values across encrypted records and can support dictionary attacks by comparing pre-encrypted candidate values.
25) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-59276)
CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to recover security-sensitive values.
The vulnerability exists due to non-constant-time comparison of sensitive values in multiple Spring Security components when validating authentication values, verifying tokens, checking password hashes, or locating OAuth2 authorizations. A remote attacker can submit a very large number of guesses and measure response latency to recover security-sensitive values.
Successful exploitation requires precise timing measurement, low network jitter, and a very large number of requests. Depending on the affected code path, recovered values may include an authentication digest, verification key, password hash, or OAuth2 token value.
26) Cross-site scripting (CVE-ID: CVE-2026-59316)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to cross-site scripting in the DefaultConsentPage when handling a crafted OAuth2 authorization request. A remote attacker can supply a malicious value that is stored server-side and later rendered unencoded in the default consent page to execute arbitrary script in the victim's browser.
User interaction is required because the malicious content is rendered in the consent page presented to the end user. Only applications using the default consent page are vulnerable.
27) Protection mechanism failure (CVE-ID: CVE-2026-59307)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper access control in JdbcMessageStore deserialization handling when deserializing data from INT_MESSAGE.MESSAGE_CONTENT. A remote privileged user can write crafted serialized bytes into INT_MESSAGE.MESSAGE_CONTENT to execute arbitrary code.
The issue occurs when the store is used as a Spring-managed bean, because setBeanClassLoader replaces the deserializing converter while the row mapper continues using a stale reference and the configured allow-list is never consulted.
28) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-59324)
CWE-ID: CWE-668 - Exposure of resource to wrong sphere
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and misroute replies.
The vulnerability exists due to improper state management in RequestMessageHolder used by fluxTransform() on FluxMessageChannel subscriptions when processing concurrent requests with an asynchronous or reordering fluxFunction that emits raw payloads. A remote attacker can send concurrent requests to disclose sensitive information and misroute replies.
The issue occurs when reply headers such as replyChannel, errorChannel, correlationId, or propagated security and tenant headers are copied from the most recently consumed upstream message.
29) Race condition (CVE-ID: CVE-2026-59321)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information or cause a denial of service.
The vulnerability exists due to improper concurrent access in shared JSR-223 ScriptEngine instances in script-backed channels when processing concurrent messages with engines that report THREADING=null. A remote user can trigger concurrent script evaluations to disclose sensitive information or cause a denial of service.
In multi-tenant or request/response flows, one message's payload or header bindings may leak into another message's script evaluation.
30) Input validation error (CVE-ID: CVE-2026-47856)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information, modify data, or cause a denial of service.
The vulnerability exists due to improper input validation in JsonToObjectTransformer when processing externally supplied json__TypeId__ message headers during JSON to object conversion. A remote user can supply a crafted header value to disclose sensitive information, modify data, or cause a denial of service.
The issue occurs when the header originates from an external producer and is mapped from the inbound transport into the message.
31) Input validation error (CVE-ID: CVE-2026-47861)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause the server to send UDP datagrams to arbitrary internal or external hosts and ports.
The vulnerability exists due to improper input validation in the Spring Integration UDP inbound adapter when parsing packet bodies. A remote user can send a crafted UDP packet to cause the server to send UDP datagrams to arbitrary internal or external hosts and ports.
The attacker controls both the destination host and port, and the emitted payload is a 36-byte UUID string.
32) Path traversal (CVE-ID: CVE-2026-47862)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to write a .zip archive to an arbitrary filesystem path outside the configured workDirectory.
The vulnerability exists due to improper input validation in ZipTransformer when using the file_name message header to build the workDirectory path. A remote user can set a specially crafted file_name header on a message to write a .zip archive to an arbitrary filesystem path outside the configured workDirectory.
The issue applies when ZipTransformer is used with ZipResultType.FILE, which is the default behavior.
33) Deserialization of Untrusted Data (CVE-ID: CVE-2026-47864)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to unsafe java deserialization in SerializingHttpMessageConverter when processing inbound HTTP requests with Content-Type application/x-java-serialized-object. A remote user can send a specially crafted serialized request body to execute arbitrary code.
Exploitation requires an application to use this converter on an inbound HTTP endpoint and to have a known Java deserialization gadget on its classpath.
34) Input validation error (CVE-ID: CVE-2026-47880)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to redirect handler output or error messages and disclose sensitive information.
The vulnerability exists due to improper input validation in DefaultJmsHeaderMapper and downstream channel resolution when processing JMS messages with user-controlled properties. A remote user can set crafted JMS properties named replyChannel, errorChannel, or json__TypeId__ to redirect handler output or error messages and disclose sensitive information.
The issue affects Spring Integration JMS inbound components that consume messages from a JMS destination.
35) Resource exhaustion (CVE-ID: CVE-2026-59274)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper resource consumption in UnZipTransformer when processing zip archives. A remote user can send a specially crafted zip archive to cause a denial of service.
36) Insecure Default Initialization of Resource (CVE-ID: CVE-2026-59293)
CWE-ID: CWE-1188 - Insecure Default Initialization of Resource
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to intercept or alter transferred files and capture NTLM credentials.
The vulnerability exists due to insecure default configuration in the SMB adapter jCIFS client configuration when negotiating the SMB protocol dialect. A remote privileged user can downgrade the connection to smb1/cifs in a machine-in-the-middle position to intercept or alter transferred files and capture NTLM credentials.
The issue occurs unless the application explicitly raises smbMinVersion.
37) Input validation error (CVE-ID: CVE-2026-47859)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in RFC6587SyslogDeserializer when processing octet-counted RFC 6587 / RFC 5424 frames. A remote user can send a frame with an arbitrarily large declared length to cause a denial of service.
The non-transparent LF-delimited framing path is not affected.
38) Deserialization of Untrusted Data (CVE-ID: CVE-2026-59306)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to deserialize untrusted types.
The vulnerability exists due to unsafe deserialization in Spring Cloud Stream when handling specially crafted input. A remote privileged user can supply crafted data to deserialize untrusted types.
User interaction is required.
39) Input validation error (CVE-ID: CVE-2026-47834)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.
The vulnerability exists due to improper input validation in Sort validation for native SQL repository methods when processing crafted Sort parameters from untrusted input. A remote attacker can supply crafted Sort or Pageable parameters to disclose sensitive information and cause a denial of service.
The issue is exposed only when sorting is enabled on repository methods using native queries and the underlying database accepts non ASCII characters as part of its SQL syntax.
40) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-59305)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and affect message integrity.
The vulnerability exists due to improper interceptor handling in the message sending functionality when sending messages. A remote privileged user can send a message to disclose sensitive information and affect message integrity.
User interaction is required.
41) Improper access control (CVE-ID: CVE-2026-59284)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify application environment properties.
The vulnerability exists due to improper access control in the writable /actuator/env endpoint when handling property update requests. A remote privileged user can send crafted requests to modify application environment properties.
The issue is exposed only when the writable /actuator/env endpoint is enabled.
42) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-47836)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to disclose sensitive information and modify data.
The vulnerability exists due to a time-of-check time-of-use race condition in the SVN base directory handling of Spring Cloud Config Server when cloning SVN repositories to the configured base directory. A local privileged user can manipulate the base directory during repository operations to disclose sensitive information and modify data.
This issue affects deployments that use SVN as the backend repository.
43) Input validation error (CVE-ID: CVE-2026-47837)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in the /monitor endpoint when handling webhook requests. A remote privileged user can send a crafted webhook request to cause a denial of service.
44) Improper access control (CVE-ID: CVE-2026-47894)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the native environment repository when resolving configuration file paths. A remote privileged user can access files outside of the configured repository path to disclose sensitive information.
45) Input validation error (CVE-ID: CVE-2026-59315)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in Spring Cloud Config Monitor when processing malicious payloads. A remote attacker can send a malicious payload to cause a denial of service.
46) Improper access control (CVE-ID: CVE-2026-47879)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to access native files and perform server-side request forgery.
The vulnerability exists due to improper access control in JsonToGrpcGatewayFilterFactory when processing proto descriptor resource locations. A remote privileged user can specify an arbitrary Spring Resource location to access native files and perform server-side request forgery.
47) Input validation error (CVE-ID: CVE-2026-59291)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to perform server-side request forgery and modify data.
The vulnerability exists due to improper input validation in Spring Cloud Function when processing crafted input. A remote privileged user can send specially crafted input to perform server-side request forgery and modify data.
User interaction is required.
48) Input validation error (CVE-ID: CVE-2026-59322)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject arbitrary message headers and influence message processing.
The vulnerability exists due to improper input validation in EmbeddedHeadersJsonMessageMapper when processing raw byte payloads with decodeNativeFormat. A remote user can send specially crafted data with embedded JSON headers to inject arbitrary message headers and influence message processing.
This affects deployments that use the mapper with default settings, such as ZeroMqChannel receiving raw socket bytes.
49) Protection mechanism failure (CVE-ID: CVE-2026-59297)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information or affect integrity checks.
The vulnerability exists due to improper security check implementation in the isSecure() implementation of ServerlessHttpServletRequest when determining whether a URI is secure. A remote privileged user can cause the application to incorrectly treat a URI as secure to disclose sensitive information or affect integrity checks.
User interaction is required.
50) Improper access control (CVE-ID: CVE-2026-59299)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and modify data.
The vulnerability exists due to improper access control in composition lookup in Spring Cloud Function when resolving composed functions. A remote privileged user can poison the base function lookup to disclose sensitive information and modify data.
User interaction is required.
51) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-59300)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper data exposure in Spring Cloud Function AWS logging when handling function invocations. A remote privileged user can trigger logging of sensitive data to disclose sensitive information.
User interaction is required.
52) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-59301)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to sensitive information exposure in Spring Cloud Function Azure when handling function invocations that are logged. A remote privileged user can trigger logging of sensitive data to disclose sensitive information.
User interaction is required.
53) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-59302)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper handling of sensitive information in logging functionality in Spring Cloud Stream when processing application data that is written to logs. A remote privileged user can trigger logging of sensitive data to disclose sensitive information.
User interaction is required.
54) Buffer overflow (CVE-ID: CVE-2026-59303)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and modify data.
The vulnerability exists due to improper bounds restriction in dynamic destination cache size handling when processing dynamic destinations. A remote privileged user can interact with crafted dynamic destinations to disclose sensitive information and modify data.
User interaction is required.
55) Use of cache containing sensitive information (CVE-ID: CVE-2026-59304)
CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose limited sensitive information and modify limited data.
The vulnerability exists due to improper caching of the original content type in Spring Cloud Stream Avro when processing avro content. A remote privileged user can use specially crafted content handling conditions to disclose limited sensitive information and modify limited data.
User interaction is required.
56) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-59298)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and affect the integrity of HTTP header handling.
The vulnerability exists due to improper filtering in HTTP headers in Spring Cloud Function when handling HTTP requests. A remote privileged user can send a specially crafted request to disclose sensitive information and affect the integrity of HTTP header handling.
User interaction is required.
57) Improper access control (CVE-ID: CVE-2026-47849)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite identifier or version properties and modify other users' records.
The vulnerability exists due to improper access control in the JSON Patch request handling code path when processing RFC 6902 JSON Patch requests. A remote user can send a specially crafted patch request to overwrite identifier or version properties and modify other users' records.
Applications are affected when the exposed repository entity declares an identifier or version property that is visible to Jackson deserialization, such as via a public setter and without explicit exclusion.
58) Improper access control (CVE-ID: CVE-2026-59318)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to invoke a tool that was not made available to the current request, potentially leading to privilege escalation.
The vulnerability exists due to improper access control in DefaultToolCallingManager tool calling support when dispatching tool calls after processing prompt-injected input. A remote user can cause dispatch of an unadvertised tool to invoke a tool that was not made available to the current request, potentially leading to privilege escalation.
User interaction is required.
59) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-47850)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite concurrent updates.
The vulnerability exists due to improper preservation of the version property in HTTP PUT handling for immutable aggregate roots when processing PUT requests against immutable target types. A remote user can submit a crafted request body containing a version value to overwrite concurrent updates.
The issue affects immutable aggregate types such as Java records, Kotlin data classes, all-args @PersistenceCreator types, and cases involving a body-driven polymorphic subtype change. Applications are affected when the version property is visible to Jackson deserialization and is not excluded via @JsonIgnore.
60) Improper access control (CVE-ID: CVE-2026-47875)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper enforcement of the trusted-types allowlist in JobParameterDeserializer when deserializing execution contexts from an untrusted data source for the job repository. A remote attacker can supply malicious serialized input to execute arbitrary code.
Exploitation is possible in applications that use Jackson2ExecutionContextStringSerializer.
61) Deserialization of Untrusted Data (CVE-ID: CVE-2026-47878)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to unsafe deserialization in DefaultExecutionContextSerializer when deserializing Base64-decoded data with ObjectInputStream.readObject() without a class allowlist. A remote attacker can supply a specially crafted serialized object to execute arbitrary code.
Only the JDBC job repository using this serializer is affected; the MongoDB backend and ResourcelessJobRepository are not affected.
62) Resource exhaustion (CVE-ID: CVE-2026-47881)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in FlatFileItemReader when processing a specially crafted multi-line input file. A remote attacker can supply a specially crafted input file to cause a denial of service.
Only applications using DefaultRecordSeparatorPolicy or JsonRecordSeparatorPolicy are vulnerable; the default SimpleRecordSeparatorPolicy is not affected.
63) Resource exhaustion (CVE-ID: CVE-2026-47860)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in message decompression when processing attacker-supplied compressed message bodies. A remote user can publish a specially crafted compressed message to cause a denial of service.
Only applications that have enabled message decompression are vulnerable. A single poison message may cause the service to crash-loop because it is redelivered after restart.
64) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-59271)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to insertion of sensitive information into log or exception messages in the BrokerNotAliveException message when the RabbitMQ management aliveness check fails. A remote user can trigger the check failure to disclose sensitive information.
This occurs when a real credential is supplied through RABBITMQ_TEST_ADMIN_PASSWORD and test output or CI logs are accessible for reading.
65) Improper Certificate Validation (CVE-ID: CVE-2026-59272)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to read or alter log traffic.
The vulnerability exists due to improper certificate validation in the Log4j2 AmqpAppender when shipping logs to RabbitMQ over TLS. A remote user can perform a man-in-the-middle attack on the network path to read or alter log traffic.
The issue affects deployments relying on the documented default behavior for hostname verification.
66) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-59292)
CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to disclose sensitive information.
The vulnerability exists due to improper access control in PropertiesPersistingMetadataStore metadata file handling when persisting metadata to a temporary file location. A local privileged user can read the world-readable metadata file to disclose sensitive information.
The issue affects the metadata store file located under a shared java.io.tmpdir path and may expose processed message keys, offsets, or idempotency markers.
67) Input validation error (CVE-ID: CVE-2026-59275)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to terminate the consumer JVM.
The vulnerability exists due to improper input validation in Java deserialization handling when processing a hostile AMQP message containing nested arrays. A remote privileged user can send a specially crafted AMQP message to terminate the consumer JVM.
The default JavaLangErrorHandler invokes System.exit(99) after the resulting StackOverflowError, causing full availability loss for workloads co-located in the same process.
68) Input validation error (CVE-ID: CVE-2026-59317)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in DeadLetterPublishingRecovererFactory when processing the retry_topic-original-timestamp header from an inbound ConsumerRecord during recovery. A remote user can send a malformed header value to cause a denial of service.
Exploitation can cause dead-letter publication to abort, after which the error handler seeks back to the failed offset and repeats the cycle indefinitely, stalling partition consumption.
69) Download of code without integrity check (CVE-ID: CVE-2026-59286)
CWE-ID: CWE-494 - Download of Code Without Integrity Check
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code in the browser and disclose sensitive information.
The vulnerability exists due to download of code without integrity check in the bundled GraphiQL page when loading JavaScript libraries from a public CDN. A remote attacker can inject malicious code into those scripts to execute arbitrary code in the browser and disclose sensitive information.
Exploitation requires the GraphiQL endpoint to be enabled and exposed, and the CDN or the network path to it to be compromised.
70) Information disclosure (CVE-ID: CVE-2026-59288)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in the GraphiQL page bundled with Spring for GraphQL when a victim with an active session follows a malicious link to the application's GraphiQL page. A remote attacker can share a malicious url to disclose sensitive information.
The application is vulnerable only when the GraphiQL endpoint is enabled and exposed, and user interaction is required.
71) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59289)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Spring Data pagination support when processing a forged GraphQL query for a Connection field. A remote attacker can send a malicious query to cause a denial of service.
The issue affects applications that expose a Connection-typed Query field backed by a Spring Data repository through auto-registration support and do not enforce additional query complexity checks.
72) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59287)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the WebSocketGraphQlClient when using the WebSocket client with keepAlive enabled. A remote attacker can interfere with the WebSocket connection to cause a denial of service.
Exploitation requires the application to use the WebSocketGraphQlClient to query a GraphQL API with the keepAlive option configured. The attacker must control the GraphQL server or perform a man-in-the-middle attack on the WebSocket connection.
73) Uncontrolled Recursion (CVE-ID: CVE-2026-47851)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to unbounded recursion in the PDF Document Reader outline tree processing when analyzing a PDF with a deeply nested or cyclic table of contents. A remote attacker can supply a crafted PDF to cause a denial of service.
The issue can trigger a StackOverflowError in the ingestion thread.
74) Deserialization of Untrusted Data (CVE-ID: CVE-2026-59278)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery via DNS resolution.
The vulnerability exists due to unsafe deserialization of untrusted java.net types in JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper when processing the spring_json_header_types message header. A remote attacker can send a specially crafted Kafka message header to perform server-side request forgery via DNS resolution.
The issue occurs in the default configuration for all @KafkaListener consumers.
Remediation
Install update from vendor's website.