Vulnerabilidades en Spring
247 resultadosCVE-2026-41726MEDIUMIn Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector headerEPSS 0.3%CVE-2026-47845MEDIUMReactor Netty HTTP Server may incorrectly evaluate proxy addressesEPSS 0.3%CVE-2026-59322MEDIUMEmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeadersEPSS 0.3%CVE-2026-47859MEDIUMUnbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoSEPSS 0.3%CVE-2026-59277LOWSpring Security InetAddressMatchers Incomplete Internal Network ClassificationEPSS 0.3%CVE-2026-47873HIGHSpring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfacesEPSS 0.3%CVE-2026-41710MEDIUMCache Exhaustion in Stateful Retries leads to Denial of ServiceEPSS 0.3%CVE-2026-41708HIGHSpring Cloud Sleuth instrumentation of Spring TX DoS vulnerabilityEPSS 0.3%CVE-2026-59324HIGHfluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunctionEPSS 0.3%CVE-2026-47877HIGHSpring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)EPSS 0.3%CVE-2026-41006HIGHSpring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configurationEPSS 0.3%CVE-2026-59272MEDIUMLog4j2 AmqpAppender disables TLS hostname verification by defaultEPSS 0.3%CVE-2026-41840MEDIUMSpring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.
Affected versions: Spring EPSS 0.3%CVE-2026-22754HIGHervlet Path Not Correctly Included in Path Matching of XML Authorization RulesEPSS 0.3%CVE-2026-59278MEDIUMIn Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packagesEPSS 0.3%CVE-2026-41849HIGHSpring Framework Denial of Service via Integer Overflow in SpEL ExpressionsEPSS 0.3%CVE-2026-41696MEDIUMSpring Data MongoDB Bind Parameter Literal Quoting BreakoutEPSS 0.3%CVE-2026-40972HIGHAn attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote seEPSS 0.3%CVE-2026-47883MEDIUMSpring Framework Open Redirect in UrlHandlerFilterEPSS 0.3%CVE-2026-47848MEDIUMReactor Netty WebSocket Client Leaks Credentials On RedirectEPSS 0.3%