Vulnerable Library - spring-boot-starter-thymeleaf-4.0.4.jar
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (spring-boot-starter-thymeleaf version) |
Remediation Possible** |
| CVE-2026-47891 |
 Critical |
9.8 |
spring-web-7.0.6.jar |
Transitive |
4.0.8 |
❌ |
| CVE-2026-40976 |
Critical |
9.1 |
spring-boot-4.0.4.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-41901 |
Critical |
9.0 |
thymeleaf-spring6-3.1.3.RELEASE.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-40478 |
Critical |
9.0 |
thymeleaf-spring6-3.1.3.RELEASE.jar |
Transitive |
4.0.5 |
❌ |
| CVE-2026-40477 |
Critical |
9.0 |
thymeleaf-spring6-3.1.3.RELEASE.jar |
Transitive |
4.0.5 |
❌ |
| CVE-2026-47889 |
 High |
7.5 |
spring-web-7.0.6.jar |
Transitive |
4.0.8 |
❌ |
| CVE-2026-47885 |
High |
7.5 |
spring-web-7.0.6.jar |
Transitive |
4.0.8 |
❌ |
| CVE-2026-41845 |
High |
7.1 |
spring-web-7.0.6.jar |
Transitive |
4.0.7 |
❌ |
| CVE-2026-40973 |
High |
7.0 |
spring-boot-4.0.4.jar |
Transitive |
4.0.6 |
❌ |
| CVE-2026-22740 |
 Medium |
6.5 |
spring-web-7.0.6.jar |
Transitive |
4.0.6 |
❌ |
| CVE-2026-59281 |
Medium |
6.1 |
spring-web-7.0.6.jar |
Transitive |
4.0.8 |
❌ |
| CVE-2026-47883 |
Medium |
6.1 |
spring-web-7.0.6.jar |
Transitive |
4.0.8 |
❌ |
| CVE-2026-41840 |
Medium |
5.9 |
spring-web-7.0.6.jar |
Transitive |
4.0.7 |
❌ |
| CVE-2026-41853 |
Medium |
5.3 |
spring-web-7.0.6.jar |
Transitive |
4.0.7 |
❌ |
| CVE-2026-40975 |
Medium |
4.8 |
spring-boot-4.0.4.jar |
Transitive |
4.0.6 |
❌ |
| CVE-2026-40977 |
Medium |
4.7 |
spring-boot-4.0.4.jar |
Transitive |
4.0.6 |
❌ |
| CVE-2026-41854 |
Medium |
4.2 |
spring-web-7.0.6.jar |
Transitive |
4.0.7 |
❌ |
| CVE-2026-41839 |
Medium |
4.2 |
spring-web-7.0.6.jar |
Transitive |
4.0.7 |
❌ |
| CVE-2026-59314 |
 Low |
3.7 |
spring-web-7.0.6.jar |
Transitive |
4.0.8 |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-47891
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Publish Date: 2026-08-27
URL: CVE-2026-47891
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
CVE-2026-40976
Vulnerable Library - spring-boot-4.0.4.jar
Spring Boot
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/4.0.4/93d6e7c5b747d640bbad17971c5ce957bee88c5f/spring-boot-4.0.4.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-boot-4.0.4.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.
Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40976
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution: org.springframework.boot:spring-boot-security:4.0.6,https://github.com/spring-projects/spring-boot.git - v4.0.6
Step up your Open Source Security Game with Mend here
CVE-2026-41901
Vulnerable Library - thymeleaf-spring6-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring6/3.1.3.RELEASE/4b276ea2bd536a18e44b40ff1d9f4848965ff59c/thymeleaf-spring6-3.1.3.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ thymeleaf-spring6-3.1.3.RELEASE.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.
Publish Date: 2026-05-12
URL: CVE-2026-41901
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-c9ph-gxww-7744
Release Date: 2026-05-05
Fix Resolution: org.thymeleaf:thymeleaf-spring6:3.1.5.RELEASE,org.thymeleaf:thymeleaf-spring5:3.1.5.RELEASE,org.thymeleaf:thymeleaf:3.1.5.RELEASE
Step up your Open Source Security Game with Mend here
CVE-2026-40478
Vulnerable Library - thymeleaf-spring6-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring6/3.1.3.RELEASE/4b276ea2bd536a18e44b40ff1d9f4848965ff59c/thymeleaf-spring6-3.1.3.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ thymeleaf-spring6-3.1.3.RELEASE.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Publish Date: 2026-04-17
URL: CVE-2026-40478
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-xjw8-8c5c-9r79
Release Date: 2026-04-17
Fix Resolution (org.thymeleaf:thymeleaf-spring6): 3.1.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.5
Step up your Open Source Security Game with Mend here
CVE-2026-40477
Vulnerable Library - thymeleaf-spring6-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring6/3.1.3.RELEASE/4b276ea2bd536a18e44b40ff1d9f4848965ff59c/thymeleaf-spring6-3.1.3.RELEASE.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ thymeleaf-spring6-3.1.3.RELEASE.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Publish Date: 2026-04-17
URL: CVE-2026-40477
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-r4v4-5mwr-2fwr
Release Date: 2026-04-17
Fix Resolution (org.thymeleaf:thymeleaf-spring6): 3.1.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.5
Step up your Open Source Security Game with Mend here
CVE-2026-47889
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Publish Date: 2026-08-27
URL: CVE-2026-47889
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
CVE-2026-47885
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Publish Date: 2026-08-27
URL: CVE-2026-47885
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
CVE-2026-41845
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41845
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41845
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2026-40973
Vulnerable Library - spring-boot-4.0.4.jar
Spring Boot
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/4.0.4/93d6e7c5b747d640bbad17971c5ce957bee88c5f/spring-boot-4.0.4.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-boot-4.0.4.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
A local attacker on the same host as the application may be able to take control of the directory used by "ApplicationTemp". When "server.servlet.session.persistent" is set to "true" and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / "ApplicationTemp" ownership verification. Versions that are no longer supported are also affected per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40973
CVSS 3 Score Details (7.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution (org.springframework.boot:spring-boot): 4.0.6
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
CVE-2026-22740
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.
Older, unsupported versions are also affected.
Publish Date: 2026-04-29
URL: CVE-2026-22740
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-22740
Release Date: 2026-04-18
Fix Resolution (org.springframework:spring-web): 7.0.7
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
CVE-2026-59281
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Publish Date: 2026-08-27
URL: CVE-2026-59281
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-59281
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
CVE-2026-47883
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Publish Date: 2026-08-27
URL: CVE-2026-47883
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
CVE-2026-41840
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.
Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41840
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41840
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2026-41853
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41853
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41853
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2026-40975
Vulnerable Library - spring-boot-4.0.4.jar
Spring Boot
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/4.0.4/93d6e7c5b747d640bbad17971c5ce957bee88c5f/spring-boot-4.0.4.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-boot-4.0.4.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40975
CVSS 3 Score Details (4.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution (org.springframework.boot:spring-boot): 4.0.6
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
CVE-2026-40977
Vulnerable Library - spring-boot-4.0.4.jar
Spring Boot
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/4.0.4/93d6e7c5b747d640bbad17971c5ce957bee88c5f/spring-boot-4.0.4.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-boot-4.0.4.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
When an application is configured to use "ApplicationPidFileWriter", a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior ("ApplicationPidFileWriter"). Versions that are no longer supported are also affected per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40977
CVSS 3 Score Details (4.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution (org.springframework.boot:spring-boot): 4.0.6
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
CVE-2026-41854
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.
Publish Date: 2026-06-09
URL: CVE-2026-41854
CVSS 3 Score Details (4.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41854
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2026-41839
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41839
CVSS 3 Score Details (4.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41839
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
CVE-2026-59314
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
- spring-boot-starter-thymeleaf-4.0.4.jar (Root Library)
- spring-boot-thymeleaf-4.0.4.jar
- ❌ spring-web-7.0.6.jar (Vulnerable Library)
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Publish Date: 2026-08-27
URL: CVE-2026-59314
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Publish Date: 2026-08-27
URL: CVE-2026-47891
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-boot-4.0.4.jar
Spring Boot
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/4.0.4/93d6e7c5b747d640bbad17971c5ce957bee88c5f/spring-boot-4.0.4.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.
Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40976
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution: org.springframework.boot:spring-boot-security:4.0.6,https://github.com/spring-projects/spring-boot.git - v4.0.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - thymeleaf-spring6-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring6/3.1.3.RELEASE/4b276ea2bd536a18e44b40ff1d9f4848965ff59c/thymeleaf-spring6-3.1.3.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.
Publish Date: 2026-05-12
URL: CVE-2026-41901
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-c9ph-gxww-7744
Release Date: 2026-05-05
Fix Resolution: org.thymeleaf:thymeleaf-spring6:3.1.5.RELEASE,org.thymeleaf:thymeleaf-spring5:3.1.5.RELEASE,org.thymeleaf:thymeleaf:3.1.5.RELEASE
Step up your Open Source Security Game with Mend here
Vulnerable Library - thymeleaf-spring6-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring6/3.1.3.RELEASE/4b276ea2bd536a18e44b40ff1d9f4848965ff59c/thymeleaf-spring6-3.1.3.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Publish Date: 2026-04-17
URL: CVE-2026-40478
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-xjw8-8c5c-9r79
Release Date: 2026-04-17
Fix Resolution (org.thymeleaf:thymeleaf-spring6): 3.1.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.5
Step up your Open Source Security Game with Mend here
Vulnerable Library - thymeleaf-spring6-3.1.3.RELEASE.jar
Library home page: http://www.thymeleaf.org
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.thymeleaf/thymeleaf-spring6/3.1.3.RELEASE/4b276ea2bd536a18e44b40ff1d9f4848965ff59c/thymeleaf-spring6-3.1.3.RELEASE.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Publish Date: 2026-04-17
URL: CVE-2026-40477
CVSS 3 Score Details (9.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-r4v4-5mwr-2fwr
Release Date: 2026-04-17
Fix Resolution (org.thymeleaf:thymeleaf-spring6): 3.1.4.RELEASE
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.5
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Publish Date: 2026-08-27
URL: CVE-2026-47889
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Publish Date: 2026-08-27
URL: CVE-2026-47885
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41845
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41845
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-boot-4.0.4.jar
Spring Boot
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/4.0.4/93d6e7c5b747d640bbad17971c5ce957bee88c5f/spring-boot-4.0.4.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
A local attacker on the same host as the application may be able to take control of the directory used by "ApplicationTemp". When "server.servlet.session.persistent" is set to "true" and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / "ApplicationTemp" ownership verification. Versions that are no longer supported are also affected per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40973
CVSS 3 Score Details (7.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution (org.springframework.boot:spring-boot): 4.0.6
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.
Older, unsupported versions are also affected.
Publish Date: 2026-04-29
URL: CVE-2026-22740
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-22740
Release Date: 2026-04-18
Fix Resolution (org.springframework:spring-web): 7.0.7
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Publish Date: 2026-08-27
URL: CVE-2026-59281
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-59281
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Publish Date: 2026-08-27
URL: CVE-2026-47883
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.
Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41840
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41840
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41853
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41853
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-boot-4.0.4.jar
Spring Boot
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/4.0.4/93d6e7c5b747d640bbad17971c5ce957bee88c5f/spring-boot-4.0.4.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40975
CVSS 3 Score Details (4.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution (org.springframework.boot:spring-boot): 4.0.6
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-boot-4.0.4.jar
Spring Boot
Library home page: https://spring.io/projects/spring-boot
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot/4.0.4/93d6e7c5b747d640bbad17971c5ce957bee88c5f/spring-boot-4.0.4.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
When an application is configured to use "ApplicationPidFileWriter", a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); PID file / symlink behavior ("ApplicationPidFileWriter"). Versions that are no longer supported are also affected per vendor advisory.
Publish Date: 2026-04-27
URL: CVE-2026-40977
CVSS 3 Score Details (4.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-04-27
Fix Resolution (org.springframework.boot:spring-boot): 4.0.6
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.
Publish Date: 2026-06-09
URL: CVE-2026-41854
CVSS 3 Score Details (4.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41854
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Publish Date: 2026-06-09
URL: CVE-2026-41839
CVSS 3 Score Details (4.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41839
Release Date: 2026-06-09
Fix Resolution (org.springframework:spring-web): 7.0.8
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-web-7.0.6.jar
Spring Web
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/7.0.6/2baeb353efd42374239cc45e8d02780d6c6e7a77/spring-web-7.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 29e5aeedb20278d4c2d9ff41b8322b5115b86941
Found in base branch: master
Vulnerability Details
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Publish Date: 2026-08-27
URL: CVE-2026-59314
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-27
Fix Resolution (org.springframework:spring-web): 7.0.9
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-thymeleaf): 4.0.8
Step up your Open Source Security Game with Mend here