Spring · week of 26 Oct 2026

Spring security note

Records on this stack that changed between 26 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.

What changed

CVE-2026-28367 — Check if you run it
A flaw was found in Undertow.
Seen in 4.0 · 3 other packages on the advisory

What we still do not know

Every changed record in this note has a version range.

Share this note

Spring security note, week of 26 Oct 2026: 1 record has a version a customer can check, and 0 still do not. https://zerodayfindings.com/technologies/spring/notes/2026-W44