redhat/xbean vulnerabilities

Latest redhat/xbean CVEs

Newest publication first

1. CVE-2026-47891 Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder

   Published 2026-08-27

   Critical·CVSS 9.8 EPSS 0.52%

   A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Frame...

2. CVE-2026-47888 Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler

   Published 2026-08-27

   High·CVSS 7.5 EPSS 0.46%

   A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5....

3. CVE-2026-41853 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux

   Published 2026-06-09

   Medium·CVSS 5.3 EPSS 0.19%

   Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

4. CVE-2025-67030 Plexus-Utils has a Directory Traversal vulnerability in its extractFile method

   Published 2026-03-25

   High·CVSS 8.8 EPSS 0.70%

   Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.