Spring
Number 72 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: Spring, spring
Total vulnerabilities
247
Critical
14
High
80
Known Exploited
0
Exploit available
0
Network, no login needed
61.4%
Of 241 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 206 | 10 | 71 | 102 | 23 | 0 |
| 2025 | 7 | 2 | 2 | 2 | 1 | 0 |
| 2024 | 15 | 2 | 6 | 5 | 2 | 0 |
| 2023 | 7 | 0 | 0 | 6 | 1 | 0 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2020 | 2 | 0 | 1 | 1 | 0 | 0 |
| 2019 | 10 | 0 | 0 | 1 | 3 | 6 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| Spring Framework | 45 | 22 |
| Spring Security | 28 | 13 |
| Spring AI | 18 | 11 |
| Spring Integration | 16 | 3 |
| Spring Boot | 15 | 5 |
| Spring Cloud Config | 10 | 4 |
| Spring for GraphQL | 9 | 7 |
| Spring AMQP | 8 | 0 |
| Spring Cloud Function | 8 | 0 |
| Spring Web Services | 8 | 3 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Allocation of Resources Without Limits or Throttling | 17 | 7 |
| Denial of Service | 15 | 9 |
| Insecure Deserialization | 15 | 8 |
| Authentication Issues | 14 | 7 |
| Path Traversal | 13 | 5 |
| Cross-Site Scripting | 9 | 5 |
| Server-Side Request Forgery | 8 | 4 |
| Improper Access Control | 7 | 5 |
| Improper Input Validation | 7 | 1 |
| Information Disclosure | 7 | 1 |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-59324 | fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction | High | 0.3% | |
| CVE-2026-59322 | EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders | Medium | 0.3% | |
| CVE-2026-59321 | Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check | Medium | 0.2% | |
| CVE-2026-59320 | In Spring AMQP the link credit never replenished on listener exception path | Medium | 0.4% | |
| CVE-2026-59319 | RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure | Medium | 0.3% | |
| CVE-2026-59317 | In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop | Medium | 0.4% | |
| CVE-2026-59316 | Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) | High | 0.3% | |
| CVE-2026-59315 | Spring Cloud Config Monitor Denial of Service | Medium | 0.4% | |
| CVE-2026-59314 | Spring Framework response splitting in ContentDisposition | Low | 0.3% | |
| CVE-2026-59313 | Server Sent Event stream corruption in Spring MVC functional web framework | Critical | 0.6% |