Spring security vulnerabilities
Developer framework / library. Public CVE monitoring for Spring Framework and Spring Boot. Vendor security advisories are linked on this page.
Built for Application teams.
32 public records · 0 security-fix timeline events. 0 published in the last 7 days. 11 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 0
- Medium 0
- Low 0
2026-08-040 issues2026-11-01
Known exploited
View all known exploitedRecently published
Browse catalog- Medium6.3Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications.Check if you run itEPSS 0.18%May 14, 2026
- Critical9.1sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot.Check if you run itEPSS 0.33%May 12, 2026
- Medium5.3Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.Check if you run itEPSS 0.34%Apr 29, 2026
- Medium6.5A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K.Check if you run itEPSS 0.34%Apr 29, 2026
- Critical9.1In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints.Check if you run itEPSS 0.49%Apr 28, 2026
- High7.5Values produced by ${random.value} are not suitable for use as secrets.Check if you run itEPSS 0.31%Apr 28, 2026
- Critical9.8Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.Check if you run itEPSS 0.18%Apr 28, 2026
- High7.0A local attacker on the same host as the application may be able to take control of the directory used by .Check if you run itEPSS 0.14%Apr 28, 2026
- High7.5An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret.Check if you run itEPSS 0.26%Apr 28, 2026
- Critical9.1When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.Check if you run itEPSS 0.16%Apr 27, 2026