VMware spring framework vulnerabilities

Latest VMware spring framework CVEs

Newest publication first · page 1 of 2

1. CVE-2026-22745 CVE-2026-22745 : Denial of service in static resource handling on Windows platforms

   Published 2026-04-29

   Medium·CVSS 5.3

   Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is serving stat...

2. CVE-2026-22741 Static resource cache poisoning in Spring MVC and WebFlux

   Published 2026-04-29

   Low·CVSS 3.1

   Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is configuring the resour...

3. CVE-2026-22740 Spring Framework DoS with Multipart Temp Files in WebFlux

   Published 2026-04-29

   Medium·CVSS 6.5

   A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsuppor...

4. CVE-2025-41254 Spring Framework STOMP CSRF Vulnerability

   Published 2025-10-16

   Medium·CVSS 4.3

   STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Spring Products and VersionsSpring Framework: 6.2.0 - 6.2.11 6.1.0 - 6.1.23 6.0.x - 6.0.29 5.3.0 - 5.3.45 Older, unsupported versions are also...

5. CVE-2025-41249 CVE-2025-41249: Spring Framework Annotation Detection Vulnerability

   Published 2025-09-16

   High·CVSS 7.5

   The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application ma...

6. CVE-2025-41242 CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

   Published 2025-08-18

   Medium·CVSS 5.9

   Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded Servlet container...

7. CVE-2025-41234 RFD Attack via “Content-Disposition” Header Sourced from Request

   Published 2025-06-12

   Medium·CVSS 6.5

   Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-su...

8. CVE-2022-22965 Remote Code Execution in Spring Framework

   Published 2022-04-01

   Critical·CVSS 9.8 EPSS 99.6% CISA KEV added 2022-04-04 Exploited in the wild Framework module Public exploit PoC

   A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e....

9. CVE-2021-22060 Log entry injection in Spring Framework

   Published 2022-01-10

   Medium·CVSS 4.3 EPSS 0.91%

   In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of inpu...

10. CVE-2021-22096 Improper Output Neutralization for Logs in Spring Framework

    Published 2021-10-28

    Medium·CVSS 4.3

    In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

11. CVE-2021-22118 Improper Privilege Management in Spring Framework

    Published 2021-05-27

    High·CVSS 7.8

    In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been up...

12. CVE-2020-5397 CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux

    Published 2020-01-17

    Medium·CVSS 5.3

    Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requ...

13. CVE-2018-15801 Spring Security vulnerable to Authorization Bypass

    Published 2018-12-19

    High·CVSS 7.4

    Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could f...

14. CVE-2018-1275 Spring Framework has Improperly Implemented Security Check for Standard

    Published 2018-04-11

    Critical·CVSS 9.8

    Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can...

15. CVE-2018-1271 Path Traversal in org.springframework:spring-core

    Published 2018-04-06

    Medium·CVSS 5.9

    Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed t...

16. CVE-2018-1272 Possible privilege escalation in org.springframework:spring-core

    Published 2018-04-06

    High·CVSS 7.5

    Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses th...

17. CVE-2018-1199 Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core

    Published 2018-03-16

    Medium·CVSS 5.3

    Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with specia...

18. CVE-2015-5211 Files or Directories Accessible to External Parties in org.springframework:spring-core

    Published 2017-05-25

    Critical·CVSS 9.6

    Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in th...

19. CVE-2014-0225 Improper Restriction of XML External Entity Reference in Spring Framework

    Published 2017-05-25

    High·CVSS 8.8

    When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

20. CVE-2016-5007 Spring Security and Spring Framework may not recognize certain paths that should be protected

    Published 2017-05-25

    High·CVSS 7.5

    Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with reg...

21. CVE-2016-9878 Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized

    Published 2016-12-29

    High·CVSS 7.5

    An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

22. CVE-2015-3192 Pivotal Spring Framework DoS Attack with XML Input

    Published 2016-07-12

    Medium·CVSS 5.5

    Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.

23. CVE-2015-0201 Moderate severity vulnerability that affects org.springframework:spring-core

    Published 2015-03-10

    Medium·CVSS 5.0

    The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.

24. CVE-2014-3625 Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

    Published 2014-11-20

    Medium·CVSS 5.0

    Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

25. CVE-2014-0054 Cross-Site Request Forgery in Spring Framework

    Published 2014-04-17

    Medium·CVSS 6.8

    The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.