最新のセキュリティ情報
2 ページ目
8月20日(木)
cve-2026-47844 - MEDIUM - Reactor Netty HTTP Server Leaks Exception Details
In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing.
cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch
Spring Data REST does not guard identifier ( @Id ) and version ( @Version ) properties against mutation via RFC 6902 JSON Patch ( application/json-patch+json ) requests. The PUT and merge-patch ( application/merge-patch+json ) code paths explicitly skip these properties during binding. The JSON Patch code path does not apply an equivalent guard, allowing an authenticated client with PATCH access to overwrite them directly. Overwriting the version property defeats optimistic-locking (lost-update) protection. Overwriting the identifier property can cause the subsequent repository save to silent…
cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.
cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT
Spring Data REST does not preserve the persisted version ( @Version ) property of an aggregate root when handling an HTTP PUT against an immutable target type. For mutable aggregates, the PUT merge logic explicitly retains the stored identifier and version properties, discarding any client-supplied values. For immutable aggregates — Java records, Kotlin data classes, all-args @PersistenceCreator types — or when a polymorphic ( @JsonTypeInfo ) subtype change occurs, the merge instead returns the request-body object and restores only Jackson @JsonIgnore -marked properties from storage. The vers…
cve-2026-47845 - MEDIUM - Reactor Netty HTTP Server may incorrectly evaluate proxy addresses
In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol.
cve-2026-47843 - LOW - Reactor Netty may incorrectly route traffic due to DNS resolver reuse
In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. In order for this to happen, the application must dynamically create multiple clients (such as HttpClient or TcpClient ) that rely on different custom configuration. This can lead to traffic being routed to unintended destinations.
cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated.
cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation
This is a continuation of CVE-2020-5408 . Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Because the IV is fixed, identical plaintexts always produce identical ciphertext for a given password and salt, regardless of when or how many times the value was encrypted. An attacker with read access to the encrypted data store can exploit this property to determine when two records share the same plaintext value, correlate encrypted values…
cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security compares UserVerificationRequirement using identity ( == ) when determining whether user verification is required during a WebAuthn ceremony. When HTTP sessions are serialized and deserialized, as occurs with distributed session stores (e.g., Spring Session with Redis or JDBC), the deserialized UserVerificationRequirement instance is not the same object reference as the static constant REQUIRED . The identity comparison evaluates to…
cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. The application is vulnerable if all of the following are true: The application accepts Sort parameters from untrusted input and uses them without prior sanitization as input for native SQL repository methods. The repository method is annotated with @NativeQuery or @Query(nativeQuery=true) . The repository method allows sorting via a Sort or Pageable parameter. The underlying database accepts non ASCII characters as part of its SQL syntax. On affected databases inf…
cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
The base directory ( spring.cloud.config.server.svn.basedir ) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks.
cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
Spring Security's DPoPProofJwtDecoderFactory uses an internal cache to store the processed jti (JWT ID) claims, which is intended to protect against replay attacks by ensuring that each DPoP proof is only used once. However, this cache has a strict maximum size limit of entries. If the attacker is able to intercept a legitimate user's valid DPoP proof, they can flood the server with dummy requests to forcefully evict the legitimate jti from the cache. Once the jti is evicted, the attacker can successfully replay the intercepted valid DPoP proof, leading to unauthorized access and impersonatio…