Known vulnerabilities in Spring Framework

Vendor: Broadcom
Software CPE: cpe:2.3:a:broadcom:pivotal_spring_framework:*:*:*:*:*:*:*:*
Total vulnerabilities: 77
Public exploits: 4
Known exploited (KEV): 1

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Spring Framework Spring Framework is affected by 77 known vulnerabilities: 1 critical, 4 high, 48 medium, 24 low Critical High Medium Low

Vulnerabilities (77)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146409 - Integer overflow
CVE-2026-41849
CWE-190 Medium
No
No
5.3.49 31.08.2026 SB20260828154
#VU146408 - Inefficient Regular Expression Complexity
CVE-2026-41848
CWE-1333 Low
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 31.08.2026 SB20260828154
SB2026090334
SB20260919171
#VU146400 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2026-59313
CWE-93 Low
No
No
5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 31.08.2026 SB20260828166
SB2026090929
SB2026100609
#VU146395 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2026-59314
CWE-113 Low
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 31.08.2026 SB20260828166
SB2026090929
#VU146382 - Improper Control of Dynamically-Managed Code Resources
CVE-2026-59283
CWE-913 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 31.08.2026 SB20260828166
SB2026090929
SB2026100612
#VU146381 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-59280
CWE-22 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 31.08.2026 SB20260828166
SB2026090929
#VU146230 - Allocation of Resources Without Limits or Throttling
CVE-2026-59282
CWE-770 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100611
#VU146229 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-59281
CWE-79 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
#VU146228 - Incorrect Authorization
CVE-2026-47892
CWE-863 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
#VU146227 - Sensitive Cookie with Improper SameSite Attribute
CVE-2026-47889
CWE-1275 Medium
No
No
6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100607
#VU146226 - Information Exposure Through an Error Message
CVE-2026-47893
CWE-209 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
#VU146225 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2026-47890
CWE-93 Low
No
No
6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100610
#VU146224 - Allocation of Resources Without Limits or Throttling
CVE-2026-47891
CWE-770 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100607
#VU146222 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2026-47883
CWE-601 Low
No
No
6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100607
#VU146221 - Allocation of Resources Without Limits or Throttling
CVE-2026-47885
CWE-770 Medium
No
No
6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100607
#VU146220 - Missing release of memory after effective lifetime
CVE-2026-47888
CWE-401 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
#VU146219 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2026-47887
CWE-601 Low
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100610
#VU146218 - Resource exhaustion
CVE-2026-47886
CWE-400 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100608
#VU146217 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-47884
CWE-22 High
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100610
#VU146174 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-41845
CWE-79 Medium
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 28.08.2026 SB20260828154
SB2026083181
SB2026083182
and 3 more


Showing elements 1 - 20 out of 77