Spring vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
32 matching records
- Medium6.3Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications.Check if you run itEPSS 0.18%May 14, 2026
- Critical9.1sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot.Check if you run itEPSS 0.33%May 12, 2026
- Medium5.3Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.Check if you run itEPSS 0.34%Apr 29, 2026
- Low3.1Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.Check if you run itEPSS 0.24%Apr 29, 2026
- Medium6.5A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K.Check if you run itEPSS 0.34%Apr 29, 2026
- Medium6.7When an application is configured to use , a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is…Check if you run itEPSS 0.11%Apr 28, 2026
- Critical9.1In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints.Check if you run itEPSS 0.49%Apr 28, 2026
- High7.5Values produced by ${random.value} are not suitable for use as secrets.Check if you run itEPSS 0.31%Apr 28, 2026
- Critical9.8Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.Check if you run itEPSS 0.18%Apr 28, 2026
- High7.0A local attacker on the same host as the application may be able to take control of the directory used by .Check if you run itEPSS 0.14%Apr 28, 2026
- High7.5An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret.Check if you run itEPSS 0.26%Apr 28, 2026
- Critical9.1When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.Check if you run itEPSS 0.16%Apr 27, 2026
- Medium6.8When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.Check if you run itEPSS 0.14%Apr 27, 2026
- Critical9.1A flaw was found in Undertow.Check if you run itEPSS 0.69%Mar 27, 2026
- Critical9.1A flaw was found in Undertow.Check if you run itEPSS 0.73%Mar 27, 2026
- Critical9.1A flaw was found in Undertow.Check if you run itEPSS 0.72%Mar 27, 2026
- Medium5.9Use of Java scripting engine enabled (e.g.Check if you run itEPSS 0.40%Mar 20, 2026
- Low2.6Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE).Check if you run itEPSS 0.12%Mar 20, 2026
- High8.1Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is decla…Check if you run itEPSS 0.37%Mar 20, 2026
- High8.1Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is decla…Check if you run itEPSS 0.34%Mar 19, 2026
- Medium4.3STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.Check if you run itEPSS 0.31%Oct 16, 2025
- High7.5The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded genericsCheck if you run itEPSS 0.48%Sep 16, 2025
- High7.5A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.Check if you run itEPSS 2.33%Sep 2, 2025
- Medium5.9Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.Check if you run itEPSS 2.13%Aug 18, 2025
- High7.7OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects.Check if you run itEPSS 4.07%May 21, 2025