springframework has 7 CVEs on record between 2024 and 2026. Disclosures have slowed: 2 in the last 90 days after 4 in the 90 before. The busiest recent month was June 2026 with 4. The median CVSS is 8.1 (high), with 2 rated critical. None have a confirmed exploitation report. Most affected products: org.springframework:spring-webflux (3), org.springframework.kafka:spring-kafka (2), org.springframework.security:spring-security-web (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 2 prev 4
Products
- org.springframework:spring-webflux 3
- org.springframework.kafka:spring-kafka 2
- org.springframework.security:spring-security-web 1
- org.springframework:spring-jms 1
Worst active — by depth score
CVE-2024-38819High· 7.5Spring Framework Path Traversal vulnerability64CVE-2026-47892Critical· 9.8Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints54CVE-2026-47890Critical· 9.8Spring Framework Server Sent Event stream corruption while rendering fragments54CVE-2026-41731High· 8.1In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization45CVE-2026-41855High· 8.1In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to u…45
springframework vulnerabilities
CVEs affecting springframework, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-47892Critical· 9.8Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-47890Critical· 9.8Spring Framework Server Sent Event stream corruption while rendering fragments
Spring Framework Server Sent Event stream corruption while rendering fragments
CVE-2026-41731High· 8.1In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
CVE-2026-41726Medium· 6.5In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
CVE-2026-47838Medium· 6.8Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
CVE-2026-41855High· 8.1In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to u…
In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to u…
CVE-2024-38819High· 7.5PoCSpring Framework Path Traversal vulnerability
Spring Framework Path Traversal vulnerability