Vulnerable Library - spring-boot-starter-thymeleaf-4.0.4.jar
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (spring-boot-starter-thymeleaf version) |
Remediation Possible** |
| CVE-2026-47891 |
 Critical |
9.8 |
spring-web-7.0.6.jar |
Transitive |
4.0.8 |
❌ |
| CVE-2026-40976 |
Critical |
9.1 |
spring-boot-4.0.4.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-41901 |
Critical |
9.0 |
detected in multiple dependencies |
Transitive |
N/A* |
❌ |
| CVE-2026-40478 |
Critical |
9.0 |
detected in multiple dependencies |
Transitive |
4.0.6 |
❌ |
| CVE-2026-40477 |
Critical |
9.0 |
detected in multiple dependencies |
Transitive |
4.0.6 |
❌ |
| CVE-2026-13006 |
 High |
7.9 |
logback-core-1.5.32.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-47889 |
High |
7.5 |
spring-web-7.0.6.jar |
Transitive |
4.0.8 |
❌ |
| CVE-2026-47885 |
High |
7.5 |
spring-web-7.0.6.jar |
Transitive |
4.0.8 |
❌ |
| CVE-2026-19880 |
High |
7.3 |
logback-classic-1.5.32.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-41845 |
High |
7.1 |
spring-web-7.0.6.jar |
Transitive |
4.0.7 |
❌ |
| CVE-2026-40973 |
High |
7.0 |
spring-boot-4.0.4.jar |
Transitive |
4.0.6 |
❌ |
| CVE-2026-22740 |
 Medium |
6.5 |
spring-web-7.0.6.jar |
Transitive |
4.0.6 |
❌ |
| CVE-2026-59281 |
Medium |
6.1 |
spring-web-7.0.6.jar |
Transitive |
4.0.8 |
❌ |
| CVE-2026-47883 |
Medium |
6.1 |
spring-web-7.0.6.jar |
Transitive |
4.0.8 |
❌ |
| CVE-2026-41840 |
Medium |
5.9 |
spring-web-7.0.6.jar |
Transitive |
4.0.7 |
❌ |
| CVE-2026-49844 |
Medium |
5.8 |
log4j-api-2.25.3.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-9828 |
Medium |
5.4 |
logback-core-1.5.32.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-10532 |
Medium |
5.4 |
logback-core-1.5.32.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-41853 |
Medium |
5.3 |
spring-web-7.0.6.jar |
Transitive |
4.0.7 |
❌ |
| CVE-2026-41001 |
Medium |
5.3 |
spring-boot-autoconfigure-4.0.4.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-40992 |
Medium |
5.0 |
spring-boot-autoconfigure-4.0.4.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-40974 |
Medium |
5.0 |
spring-boot-autoconfigure-4.0.4.jar |
Transitive |
4.0.6 |
❌ |
| CVE-2026-40971 |
Medium |
5.0 |
spring-boot-autoconfigure-4.0.4.jar |
Transitive |
4.0.6 |
❌ |
| CVE-2026-40975 |
Medium |
4.8 |
spring-boot-4.0.4.jar |
Transitive |
4.0.6 |
❌ |
| CVE-2026-40977 |
Medium |
4.7 |
spring-boot-4.0.4.jar |
Transitive |
4.0.6 |
❌ |
| CVE-2026-41854 |
Medium |
4.2 |
spring-web-7.0.6.jar |
Transitive |
4.0.7 |
❌ |
| CVE-2026-41839 |
Medium |
4.2 |
spring-web-7.0.6.jar |
Transitive |
4.0.7 |
❌ |
| CVE-2026-59314 |
 Low |
3.7 |
spring-web-7.0.6.jar |
Transitive |
4.0.8 |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Partial details (22 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
CVE-2026-47891
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Publish Date: 2026-08-27
URL: CVE-2026-47891
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
CVE-2026-40976
Vulnerable Library - spring-boot-4.0.4.jar
Spring Boot
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/4.0.4/93d6e7c5b747d640bbad17971c5ce957bee88c5f/spring-boot-4.0.4.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-boot-4.0.4.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.
Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40976
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution: org.springframework.boot:spring-boot-security:4.0.6,https://github.com/spring-projects/spring-boot.git - v4.0.6
Step up your Open Source Security Game with Mend here
CVE-2026-41901
Vulnerable Libraries - thymeleaf-spring6-3.1.3.RELEASE.jar, thymeleaf-3.1.3.RELEASE.jar
thymeleaf-spring6-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring6/3.1.3.RELEASE/4b276ea2bd536a18e44b40ff1d9f4848965ff59c/thymeleaf-spring6-3.1.3.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ thymeleaf-spring6-3.1.3.RELEASE.jar (Vulnerable Library)
thymeleaf-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf/3.1.3.RELEASE/51474f2a90b282ee97dabcd159c7faf24790f373/thymeleaf-3.1.3.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- thymeleaf-spring6-3.1.3.RELEASE.jar
- ❌ thymeleaf-3.1.3.RELEASE.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.
Publish Date: 2026-05-12
URL: CVE-2026-41901
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-c9ph-gxww-7744
Release Date: 2026-05-05
Fix Resolution: org.thymeleaf:thymeleaf-spring6:3.1.5.RELEASE,org.thymeleaf:thymeleaf-spring5:3.1.5.RELEASE,org.thymeleaf:thymeleaf:3.1.5.RELEASE
Step up your Open Source Security Game with Mend here
CVE-2026-40478
Vulnerable Libraries - thymeleaf-3.1.3.RELEASE.jar, thymeleaf-spring6-3.1.3.RELEASE.jar
thymeleaf-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf/3.1.3.RELEASE/51474f2a90b282ee97dabcd159c7faf24790f373/thymeleaf-3.1.3.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- thymeleaf-spring6-3.1.3.RELEASE.jar
- ❌ thymeleaf-3.1.3.RELEASE.jar (Vulnerable Library)
thymeleaf-spring6-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring6/3.1.3.RELEASE/4b276ea2bd536a18e44b40ff1d9f4848965ff59c/thymeleaf-spring6-3.1.3.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ thymeleaf-spring6-3.1.3.RELEASE.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Publish Date: 2026-04-17
URL: CVE-2026-40478
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-xjw8-8c5c-9r79
Release Date: 2026-04-17
Fix Resolution (org.thymeleaf:thymeleaf): 3.1.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Fix Resolution (org.thymeleaf:thymeleaf-spring6): 3.1.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
CVE-2026-40477
Vulnerable Libraries - thymeleaf-3.1.3.RELEASE.jar, thymeleaf-spring6-3.1.3.RELEASE.jar
thymeleaf-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf/3.1.3.RELEASE/51474f2a90b282ee97dabcd159c7faf24790f373/thymeleaf-3.1.3.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- thymeleaf-spring6-3.1.3.RELEASE.jar
- ❌ thymeleaf-3.1.3.RELEASE.jar (Vulnerable Library)
thymeleaf-spring6-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring6/3.1.3.RELEASE/4b276ea2bd536a18e44b40ff1d9f4848965ff59c/thymeleaf-spring6-3.1.3.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ thymeleaf-spring6-3.1.3.RELEASE.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Publish Date: 2026-04-17
URL: CVE-2026-40477
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-r4v4-5mwr-2fwr
Release Date: 2026-04-17
Fix Resolution (org.thymeleaf:thymeleaf): 3.1.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Fix Resolution (org.thymeleaf:thymeleaf-spring6): 3.1.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
CVE-2026-13006
Vulnerable Library - logback-core-1.5.32.jar
logback-core module
Library home page: http://logback.qos.ch
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-core/1.5.32/fdfb3ff9a842303d4a95207294a6c6bc64e2605d/logback-core-1.5.32.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-starter-4.0.4.jar
- spring-boot-starter-logging-4.0.4.jar
- logback-classic-1.5.32.jar
- ❌ logback-core-1.5.32.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration file or by injecting an environment variable before program execution.
A successful attack requires the presence of Janino library to be present on the user's class path. In addition, the attacker must have write access to a
configuration file. Alternatively, the attacker could inject a malicious
environment variable pointing to a malicious configuration file. In both
cases, the attack requires existing privilege.
Please note that in logack version 1.5.37 conditional processing using Janino was removed.
Publish Date: 2026-06-24
URL: CVE-2026-13006
CVSS 3 Score Details (7.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-24
Fix Resolution: https://github.com/qos-ch/logback.git - v_1.5.35,ch.qos.logback:logback-core:1.5.35
Step up your Open Source Security Game with Mend here
CVE-2026-47889
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Publish Date: 2026-08-27
URL: CVE-2026-47889
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
CVE-2026-47885
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Publish Date: 2026-08-27
URL: CVE-2026-47885
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
CVE-2026-19880
Vulnerable Library - logback-classic-1.5.32.jar
logback-classic module
Library home page: http://logback.qos.ch
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-classic/1.5.32/2b1042c50f508f2eb402bd4d22ccbdf94cc37d2e/logback-classic-1.5.32.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-starter-4.0.4.jar
- spring-boot-starter-logging-4.0.4.jar
- ❌ logback-classic-1.5.32.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an
MDC-based discriminator value flows unsanitized into a nested
FileAppender path, letting an attacker who influences that MDC value
(e.g. via an HTTP header)
create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
Publish Date: 2026-08-14
URL: CVE-2026-19880
CVSS 3 Score Details (7.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://logback.qos.ch/news.html#1.6.3
Release Date: 2026-08-14
Fix Resolution: ch.qos.logback:logback-classic:1.6.3
Step up your Open Source Security Game with Mend here
CVE-2026-41845
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41845
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41845
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2026-40973
Vulnerable Library - spring-boot-4.0.4.jar
Spring Boot
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/4.0.4/93d6e7c5b747d640bbad17971c5ce957bee88c5f/spring-boot-4.0.4.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-boot-4.0.4.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
A local attacker on the same host as the application may be able to take control of the directory used by "ApplicationTemp". When "server.servlet.session.persistent" is set to "true" and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / "ApplicationTemp" ownership verification. Versions that are no longer supported are also affected per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40973
CVSS 3 Score Details (7.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution (org.springframework.boot:spring-boot): 4.0.6
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
CVE-2026-22740
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.
Older, unsupported versions are also affected.
Publish Date: 2026-04-29
URL: CVE-2026-22740
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-22740
Release Date: 2026-04-18
Fix Resolution (org.springframework:spring-web): 7.0.7
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
CVE-2026-59281
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Publish Date: 2026-08-27
URL: CVE-2026-59281
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-59281
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
CVE-2026-47883
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Publish Date: 2026-08-27
URL: CVE-2026-47883
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
CVE-2026-41840
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.
Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41840
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41840
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2026-49844
Vulnerable Library - log4j-api-2.25.3.jar
The logging API of the Log4j project.
Library and application code can log through this API.
It contains a simple built-in implementation (`SimpleLogger`) for trivial use cases.
Production applications are recommended to use Log4j API in combination with a fully-fledged implementation, such as Log4j Core.
Library home page: https://logging.apache.org/log4j/2.x/
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.apache.logging.log4j/log4j-api/2.25.3/fb385330d89c2d61058ef649403f214633569205/log4j-api-2.25.3.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-starter-4.0.4.jar
- spring-boot-starter-logging-4.0.4.jar
- log4j-to-slf4j-2.25.3.jar
- ❌ log4j-api-2.25.3.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
- The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}).
- The application logs a MapMessage that contains an attacker-controlled floating-point value.
An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.
Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
Publish Date: 2026-07-10
URL: CVE-2026-49844
CVSS 3 Score Details (5.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://logging.apache.org/security.html#CVE-2026-49844
Release Date: 2026-07-10
Fix Resolution: org.apache.logging.log4j:log4j-api:2.25.5
Step up your Open Source Security Game with Mend here
CVE-2026-9828
Vulnerable Library - logback-core-1.5.32.jar
logback-core module
Library home page: http://logback.qos.ch
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-core/1.5.32/fdfb3ff9a842303d4a95207294a6c6bc64e2605d/logback-core-1.5.32.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-starter-4.0.4.jar
- spring-boot-starter-logging-4.0.4.jar
- logback-classic-1.5.32.jar
- ❌ logback-core-1.5.32.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted.
More precisely, an attacker able to influence serialized data sent to
SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from
classes in the java.lang and java.util packages that are not explicitly
blocked.
Although deserialization is heavily restricted by HardenedObjectInputStream and no
practical way to achieve remote code execution or significant privilege
escalation has been identified, this issue constitutes a bypass of the
intended security restrictions.
This issue affects logback: through 1.5.32 inclusive.
Publish Date: 2026-05-28
URL: CVE-2026-9828
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://logback.qos.ch/news.html#1.5.33
Release Date: 2026-05-28
Fix Resolution: ch.qos.logback:logback-core:1.5.33
Step up your Open Source Security Game with Mend here
CVE-2026-10532
Vulnerable Library - logback-core-1.5.32.jar
logback-core module
Library home page: http://logback.qos.ch
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-core/1.5.32/fdfb3ff9a842303d4a95207294a6c6bc64e2605d/logback-core-1.5.32.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-starter-4.0.4.jar
- spring-boot-starter-logging-4.0.4.jar
- logback-classic-1.5.32.jar
- ❌ logback-core-1.5.32.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.
More precisely, an attacker able to influence serialized data sent to
SimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.
Although deserialization is heavily restricted by HardenedObjectInputStream and no
practical way to achieve remote code execution or significant privilege
escalation has been identified, this issue constitutes a bypass of the
intended security restrictions.
This issue affects logback: through 1.5.33 inclusive.
Publish Date: 2026-06-01
URL: CVE-2026-10532
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-01
Fix Resolution: https://github.com/qos-ch/logback.git - v_1.5.34
Step up your Open Source Security Game with Mend here
CVE-2026-41853
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41853
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41853
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2026-41001
Vulnerable Library - spring-boot-autoconfigure-4.0.4.jar
Spring Boot AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot-autoconfigure/4.0.4/e7d484851da96008f341cab0336ff7b923ba25ae/spring-boot-autoconfigure-4.0.4.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-starter-4.0.4.jar
- ❌ spring-boot-autoconfigure-4.0.4.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.
Affected versions:
Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
Publish Date: 2026-06-11
URL: CVE-2026-41001
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-11
Fix Resolution: https://github.com/spring-projects/spring-boot.git - v3.5.15,https://github.com/spring-projects/spring-boot.git - v4.0.7
Step up your Open Source Security Game with Mend here
CVE-2026-40992
Vulnerable Library - spring-boot-autoconfigure-4.0.4.jar
Spring Boot AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot-autoconfigure/4.0.4/e7d484851da96008f341cab0336ff7b923ba25ae/spring-boot-autoconfigure-4.0.4.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-starter-4.0.4.jar
- ❌ spring-boot-autoconfigure-4.0.4.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.
Affected versions:
Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
Publish Date: 2026-06-11
URL: CVE-2026-40992
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Adjacent
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-11
Fix Resolution: https://github.com/spring-projects/spring-boot.git - v3.5.15,https://github.com/spring-projects/spring-boot.git - v4.0.7
Step up your Open Source Security Game with Mend here
CVE-2026-40974
Vulnerable Library - spring-boot-autoconfigure-4.0.4.jar
Spring Boot AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot-autoconfigure/4.0.4/e7d484851da96008f341cab0336ff7b923ba25ae/spring-boot-autoconfigure-4.0.4.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-starter-4.0.4.jar
- ❌ spring-boot-autoconfigure-4.0.4.jar (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40974
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Adjacent
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution (org.springframework.boot:spring-boot-autoconfigure): 4.0.6
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Publish Date: 2026-08-27
URL: CVE-2026-47891
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-boot-4.0.4.jar
Spring Boot
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/4.0.4/93d6e7c5b747d640bbad17971c5ce957bee88c5f/spring-boot-4.0.4.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.
Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40976
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution: org.springframework.boot:spring-boot-security:4.0.6,https://github.com/spring-projects/spring-boot.git - v4.0.6
Step up your Open Source Security Game with Mend here
Vulnerable Libraries - thymeleaf-spring6-3.1.3.RELEASE.jar, thymeleaf-3.1.3.RELEASE.jar
thymeleaf-spring6-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring6/3.1.3.RELEASE/4b276ea2bd536a18e44b40ff1d9f4848965ff59c/thymeleaf-spring6-3.1.3.RELEASE.jar
Dependency Hierarchy:
thymeleaf-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf/3.1.3.RELEASE/51474f2a90b282ee97dabcd159c7faf24790f373/thymeleaf-3.1.3.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.
Publish Date: 2026-05-12
URL: CVE-2026-41901
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-c9ph-gxww-7744
Release Date: 2026-05-05
Fix Resolution: org.thymeleaf:thymeleaf-spring6:3.1.5.RELEASE,org.thymeleaf:thymeleaf-spring5:3.1.5.RELEASE,org.thymeleaf:thymeleaf:3.1.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Libraries - thymeleaf-3.1.3.RELEASE.jar, thymeleaf-spring6-3.1.3.RELEASE.jar
thymeleaf-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf/3.1.3.RELEASE/51474f2a90b282ee97dabcd159c7faf24790f373/thymeleaf-3.1.3.RELEASE.jar
Dependency Hierarchy:
thymeleaf-spring6-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring6/3.1.3.RELEASE/4b276ea2bd536a18e44b40ff1d9f4848965ff59c/thymeleaf-spring6-3.1.3.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Publish Date: 2026-04-17
URL: CVE-2026-40478
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-xjw8-8c5c-9r79
Release Date: 2026-04-17
Fix Resolution (org.thymeleaf:thymeleaf): 3.1.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Fix Resolution (org.thymeleaf:thymeleaf-spring6): 3.1.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
Vulnerable Libraries - thymeleaf-3.1.3.RELEASE.jar, thymeleaf-spring6-3.1.3.RELEASE.jar
thymeleaf-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf/3.1.3.RELEASE/51474f2a90b282ee97dabcd159c7faf24790f373/thymeleaf-3.1.3.RELEASE.jar
Dependency Hierarchy:
thymeleaf-spring6-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring6/3.1.3.RELEASE/4b276ea2bd536a18e44b40ff1d9f4848965ff59c/thymeleaf-spring6-3.1.3.RELEASE.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Publish Date: 2026-04-17
URL: CVE-2026-40477
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-r4v4-5mwr-2fwr
Release Date: 2026-04-17
Fix Resolution (org.thymeleaf:thymeleaf): 3.1.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Fix Resolution (org.thymeleaf:thymeleaf-spring6): 3.1.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - logback-core-1.5.32.jar
logback-core module
Library home page: http://logback.qos.ch
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-core/1.5.32/fdfb3ff9a842303d4a95207294a6c6bc64e2605d/logback-core-1.5.32.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration file or by injecting an environment variable before program execution.
A successful attack requires the presence of Janino library to be present on the user's class path. In addition, the attacker must have write access to a
configuration file. Alternatively, the attacker could inject a malicious
environment variable pointing to a malicious configuration file. In both
cases, the attack requires existing privilege.
Please note that in logack version 1.5.37 conditional processing using Janino was removed.
Publish Date: 2026-06-24
URL: CVE-2026-13006
CVSS 3 Score Details (7.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-24
Fix Resolution: https://github.com/qos-ch/logback.git - v_1.5.35,ch.qos.logback:logback-core:1.5.35
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Publish Date: 2026-08-27
URL: CVE-2026-47889
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Publish Date: 2026-08-27
URL: CVE-2026-47885
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - logback-classic-1.5.32.jar
logback-classic module
Library home page: http://logback.qos.ch
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-classic/1.5.32/2b1042c50f508f2eb402bd4d22ccbdf94cc37d2e/logback-classic-1.5.32.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an
MDC-based discriminator value flows unsanitized into a nested
FileAppender path, letting an attacker who influences that MDC value
(e.g. via an HTTP header)
create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
Publish Date: 2026-08-14
URL: CVE-2026-19880
CVSS 3 Score Details (7.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://logback.qos.ch/news.html#1.6.3
Release Date: 2026-08-14
Fix Resolution: ch.qos.logback:logback-classic:1.6.3
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41845
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41845
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-boot-4.0.4.jar
Spring Boot
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/4.0.4/93d6e7c5b747d640bbad17971c5ce957bee88c5f/spring-boot-4.0.4.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
A local attacker on the same host as the application may be able to take control of the directory used by "ApplicationTemp". When "server.servlet.session.persistent" is set to "true" and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / "ApplicationTemp" ownership verification. Versions that are no longer supported are also affected per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40973
CVSS 3 Score Details (7.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution (org.springframework.boot:spring-boot): 4.0.6
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.
Older, unsupported versions are also affected.
Publish Date: 2026-04-29
URL: CVE-2026-22740
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-22740
Release Date: 2026-04-18
Fix Resolution (org.springframework:spring-web): 7.0.7
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Publish Date: 2026-08-27
URL: CVE-2026-59281
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-59281
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Publish Date: 2026-08-27
URL: CVE-2026-47883
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.
Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41840
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41840
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - log4j-api-2.25.3.jar
The logging API of the Log4j project. Library and application code can log through this API. It contains a simple built-in implementation (`SimpleLogger`) for trivial use cases. Production applications are recommended to use Log4j API in combination with a fully-fledged implementation, such as Log4j Core.
Library home page: https://logging.apache.org/log4j/2.x/
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.apache.logging.log4j/log4j-api/2.25.3/fb385330d89c2d61058ef649403f214633569205/log4j-api-2.25.3.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.
Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
Publish Date: 2026-07-10
URL: CVE-2026-49844
CVSS 3 Score Details (5.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://logging.apache.org/security.html#CVE-2026-49844
Release Date: 2026-07-10
Fix Resolution: org.apache.logging.log4j:log4j-api:2.25.5
Step up your Open Source Security Game with Mend here
Vulnerable Library - logback-core-1.5.32.jar
logback-core module
Library home page: http://logback.qos.ch
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-core/1.5.32/fdfb3ff9a842303d4a95207294a6c6bc64e2605d/logback-core-1.5.32.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted.
More precisely, an attacker able to influence serialized data sent to
SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from
classes in the java.lang and java.util packages that are not explicitly
blocked.
Although deserialization is heavily restricted by HardenedObjectInputStream and no
practical way to achieve remote code execution or significant privilege
escalation has been identified, this issue constitutes a bypass of the
intended security restrictions.
This issue affects logback: through 1.5.32 inclusive.
Publish Date: 2026-05-28
URL: CVE-2026-9828
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://logback.qos.ch/news.html#1.5.33
Release Date: 2026-05-28
Fix Resolution: ch.qos.logback:logback-core:1.5.33
Step up your Open Source Security Game with Mend here
Vulnerable Library - logback-core-1.5.32.jar
logback-core module
Library home page: http://logback.qos.ch
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/ch.qos.logback/logback-core/1.5.32/fdfb3ff9a842303d4a95207294a6c6bc64e2605d/logback-core-1.5.32.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.
More precisely, an attacker able to influence serialized data sent to
SimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.
Although deserialization is heavily restricted by HardenedObjectInputStream and no
practical way to achieve remote code execution or significant privilege
escalation has been identified, this issue constitutes a bypass of the
intended security restrictions.
This issue affects logback: through 1.5.33 inclusive.
Publish Date: 2026-06-01
URL: CVE-2026-10532
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-01
Fix Resolution: https://github.com/qos-ch/logback.git - v_1.5.34
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41853
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41853
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-boot-autoconfigure-4.0.4.jar
Spring Boot AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot-autoconfigure/4.0.4/e7d484851da96008f341cab0336ff7b923ba25ae/spring-boot-autoconfigure-4.0.4.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts.
Affected versions:
Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16; 3.3.0 through 3.3.19; 2.7.0 through 2.7.33.
Publish Date: 2026-06-11
URL: CVE-2026-41001
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-11
Fix Resolution: https://github.com/spring-projects/spring-boot.git - v3.5.15,https://github.com/spring-projects/spring-boot.git - v4.0.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-boot-autoconfigure-4.0.4.jar
Spring Boot AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot-autoconfigure/4.0.4/e7d484851da96008f341cab0336ff7b923ba25ae/spring-boot-autoconfigure-4.0.4.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected.
Affected versions:
Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4.0 through 3.4.16.
Publish Date: 2026-06-11
URL: CVE-2026-40992
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Adjacent
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-11
Fix Resolution: https://github.com/spring-projects/spring-boot.git - v3.5.15,https://github.com/spring-projects/spring-boot.git - v4.0.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-boot-autoconfigure-4.0.4.jar
Spring Boot AutoConfigure
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle.kts
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot-autoconfigure/4.0.4/e7d484851da96008f341cab0336ff7b923ba25ae/spring-boot-autoconfigure-4.0.4.jar
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); Cassandra SSL auto-configuration. Versions that are no longer supported are also affected per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40974
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Adjacent
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution (org.springframework.boot:spring-boot-autoconfigure): 4.0.6
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here