Known vulnerabilities in Spring Framework 6.0.31

Vendor: Broadcom
Version: 6.0.31
Software CPE: cpe:2.3:a:broadcom:pivotal_spring_framework:*:*:*:*:*:*:*:*
Total vulnerabilities: 15
Public exploits: 0
Known exploited (KEV): 0

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Spring Framework version 6.0.31 Spring Framework 6.0.31 is affected by 15 vulnerabilities: 1 high, 9 medium, 5 low Critical High Medium Low

Vulnerabilities (15)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146414 - Deserialization of Untrusted Data
CVE-2026-41855
CWE-502 High
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 31.08.2026 SB20260828154
SB2026100258
#VU146413 - Allocation of Resources Without Limits or Throttling
CVE-2026-41850
CWE-770 Medium
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 31.08.2026 SB20260828154
SB2026083172
SB2026083181
and 1 more
#VU146412 - Protection Mechanism Failure
CVE-2026-41852
CWE-693 Low
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 31.08.2026 SB20260828154
SB2026092114
#VU146411 - Improper input validation
CVE-2026-41853
CWE-20 Medium
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 31.08.2026 SB20260828154
SB20260917195
SB20260919172
#VU146410 - Resource exhaustion
CVE-2026-41851
CWE-400 Medium
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 31.08.2026 SB20260828154
SB2026083172
SB2026083181
and 1 more
#VU146408 - Inefficient Regular Expression Complexity
CVE-2026-41848
CWE-1333 Low
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 31.08.2026 SB20260828154
SB2026090334
SB20260919171
#VU146176 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-41846
CWE-79 Medium
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 28.08.2026 SB20260828154
SB2026092115
#VU146174 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-41845
CWE-79 Medium
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 28.08.2026 SB20260828154
SB2026083181
SB2026083182
and 3 more
#VU146173 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-41843
CWE-22 Medium
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 28.08.2026 SB20260828154
SB2026092115
#VU146172 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2026-41844
CWE-601 Low
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 28.08.2026 SB20260828154
SB2026092115
#VU146171 - Session Fixation
CVE-2026-41839
CWE-384 Low
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 28.08.2026 SB20260828154
SB20260917195
SB20260919172
and 1 more
#VU146170 - Resource exhaustion
CVE-2026-41842
CWE-400 Medium
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 28.08.2026 SB20260828154
SB2026083172
SB2026083181
and 3 more
#VU146169 - Improper Access Control
CVE-2026-41841
CWE-284 Medium
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 28.08.2026 SB20260828154
SB20260917195
SB2026092115
#VU146167 - Generation of Predictable Numbers or Identifiers
CVE-2026-41838
CWE-340 Low
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 28.08.2026 SB20260828154
SB2026100258
#VU146166 - Missing release of memory after effective lifetime
CVE-2026-41840
CWE-401 Medium
No
No
5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8 28.08.2026 SB20260828154
SB20260917195
SB20260919172
and 1 more