Known vulnerabilities in Spring Framework 6.1.28

Vendor: Broadcom
Version: 6.1.28
Software CPE: cpe:2.3:a:broadcom:pivotal_spring_framework:*:*:*:*:*:*:*:*
Total vulnerabilities: 14
Public exploits: 0
Known exploited (KEV): 0

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Spring Framework version 6.1.28 Spring Framework 6.1.28 is affected by 14 vulnerabilities: 1 high, 10 medium, 3 low Critical High Medium Low

Vulnerabilities (14)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146400 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVE-2026-59313
CWE-93 Low
No
No
5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 31.08.2026 SB20260828166
SB2026090929
SB2026100609
#VU146395 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2026-59314
CWE-113 Low
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 31.08.2026 SB20260828166
SB2026090929
#VU146382 - Improper Control of Dynamically-Managed Code Resources
CVE-2026-59283
CWE-913 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 31.08.2026 SB20260828166
SB2026090929
SB2026100612
#VU146381 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-59280
CWE-22 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 31.08.2026 SB20260828166
SB2026090929
#VU146230 - Allocation of Resources Without Limits or Throttling
CVE-2026-59282
CWE-770 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100611
#VU146229 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-59281
CWE-79 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
#VU146228 - Incorrect Authorization
CVE-2026-47892
CWE-863 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
#VU146226 - Information Exposure Through an Error Message
CVE-2026-47893
CWE-209 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
#VU146224 - Allocation of Resources Without Limits or Throttling
CVE-2026-47891
CWE-770 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100607
#VU146221 - Allocation of Resources Without Limits or Throttling
CVE-2026-47885
CWE-770 Medium
No
No
6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100607
#VU146220 - Missing release of memory after effective lifetime
CVE-2026-47888
CWE-401 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
#VU146219 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2026-47887
CWE-601 Low
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100610
#VU146218 - Resource exhaustion
CVE-2026-47886
CWE-400 Medium
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100608
#VU146217 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-47884
CWE-22 High
No
No
5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9 28.08.2026 SB20260828166
SB2026090929
SB2026100610