Vulnerabilidades em Spring

247 resultados
Análise Vexday

O ecossistema Spring acumula 149 CVEs catalogadas, com um volume expressivo de 98 vulnerabilidades surgidas nos últimos 90 dias, o que indica ritmo elevado de descoberta recente e demanda atenção contínua no processo de atualização. A taxa de exploração ativa está abaixo da média geral do catálogo CISA KEV, com nenhuma CVE confirmada em uso por atores maliciosos no momento, embora a presença de 8 vulnerabilidades com PoC pública e 7 de severidade crítica represente superfície de risco relevante. O tipo de falha mais frequente é CWE-400 (consumo descontrolado de recursos), sugerindo que controles de limitação de entrada e de recursos devem ser priorizados nas revisões de configuração. A CVE mais perigosa identificada é CVE-2020-5398, com score EPSS de 0,88, indicando alta probabilidade estatística de exploração — ambientes que ainda não aplicaram a correção correspondente devem tratá-la com urgência.

CVE-2026-47880MEDIUMDefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant namesEPSS 0.3%CVE-2026-41720HIGHAuthentication Bypass with Empty Password in Spring LDAPEPSS 0.3%CVE-2026-59314LOWSpring Framework response splitting in ContentDispositionEPSS 0.3%CVE-2026-47843LOWReactor Netty may incorrectly route traffic due to DNS resolver reuseEPSS 0.3%CVE-2026-22744HIGHIn RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, strinEPSS 0.3%CVE-2026-22743HIGHServer-Side Request Forgery via Filter Expression Keys in Neo4jVectorStoreEPSS 0.3%CVE-2026-59318MEDIUMDefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt InjectionEPSS 0.3%CVE-2026-59281MEDIUMSpring Framework Cross-site Scripting via EscapedErrorsEPSS 0.3%CVE-2026-22753HIGHServlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchersEPSS 0.2%CVE-2026-59291LOWPotential arbitrary file read and SSRF vulnerability in Spring Cloud FunctionEPSS 0.2%CVE-2026-47844MEDIUMReactor Netty HTTP Server Leaks Exception DetailsEPSS 0.2%CVE-2026-47882HIGHSpring Boot DevTools remote secret generated with a non-cryptographic PRNGEPSS 0.2%CVE-2026-40980MEDIUMIn Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayEPSS 0.2%CVE-2026-47887MEDIUMSpring Framework Open Redirect in UrlFileNameViewControllerEPSS 0.2%CVE-2026-41727MEDIUMIn Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behaviorEPSS 0.2%CVE-2026-22747MEDIUMUnauthorized User Impersonation when Using X.509 Client CertificatesEPSS 0.2%CVE-2026-59293MEDIUMSMB minimum protocol dialect defaults to SMB1EPSS 0.2%CVE-2026-59302LOWPotential for logging sensitive data in Spring Cloud StreamEPSS 0.2%CVE-2026-59301LOWPotential for logging sensitive data in Spring Cloud Function AzureEPSS 0.2%CVE-2026-40985MEDIUMData Binding Vulnerability in Spring Web Flow with Unified EL ParserEPSS 0.2%