Vulnerabilidades en Spring
247 resultadosCVE-2025-22235HIGHSpring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposedEPSS 0.4%CVE-2026-59285HIGHSpring for GraphQL Unsafe Deserialization in pagination supportEPSS 0.4%CVE-2026-40981HIGHWhen using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentiaEPSS 0.4%CVE-2025-22233LOWSpring Framework DataBinder Case Sensitive Match ExceptionEPSS 0.4%CVE-2026-41699HIGHUnsafe Deserialization in Spring GraphQLEPSS 0.4%CVE-2026-47889HIGHSpring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponseEPSS 0.4%CVE-2026-59284MEDIUMSpring Cloud Commons no allow list for writable env actuator endpointEPSS 0.4%CVE-2026-47875MEDIUMJobParameterDeserializer bypasses the trusted-type allowlistEPSS 0.4%CVE-2026-47860MEDIUMUnbounded decompression of attacker-supplied compressed message bodiesEPSS 0.4%CVE-2026-59274MEDIUMUnbounded decompression in UnZipTransformer enables zip-bomb DoSEPSS 0.4%CVE-2026-59317MEDIUMIn Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loopEPSS 0.4%CVE-2026-59320MEDIUMIn Spring AMQP the link credit never replenished on listener exception pathEPSS 0.4%CVE-2023-34047LOWExposure of data and identity to wrong session in Spring for GraphQLEPSS 0.4%CVE-2026-59307HIGHDeserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale referenceEPSS 0.4%CVE-2026-22737MEDIUMSpring Framework Improper Path Limitation with Script View TemplatesEPSS 0.4%CVE-2026-41729HIGHSpring Data REST SpEL Injection via Map Key in JSON PatchEPSS 0.4%CVE-2026-47863MEDIUMReactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flushEPSS 0.4%CVE-2026-47881MEDIUMDenial of Service in Spring Batch FlatFileItemReader via Malformed Input FileEPSS 0.4%CVE-2026-59270CRITICALSpring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfacesEPSS 0.4%CVE-2026-47874MEDIUMReactor Netty HTTP Server Denial of Service With Pipelined RequestsEPSS 0.4%