Spring Security Advisoriesの情報
8月20日(木)
cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader . Under these conditions, a view name containing backslash sequences can escape the configured template directory, potentially exposing files that should not be accessible. Returning a view name derived from untrusted input is an application-level anti-pattern that Spring documentation warns against; applications that do not do so are not affect…
cve-2026-59279 - HIGH - Unbounded persistent session allocation via repeated initialize requests
The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over time, gradually exhausting available memory and ultimately causing a Denial of Service that affects all legitimate clients.
cve-2026-59272 - MEDIUM - Log4j2 AmqpAppender disables TLS hostname verification by default
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Attackers on the network path can read or alter log traffic (often containing tokens, PII, or stack traces with secrets) without certificate errors. The docs promise hostname verification is on by default, so operators have no reason to suspect exposure.
cve-2026-59282 - MEDIUM - Spring Framework Denial of Service via Unbounded List Growth in Data Binding
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework's property binding infrastructure traverses nested property paths by calling list.get(index) to navigate into list elements. This call is made without verifying that the index falls within the list's current bounds after the configured autoGrowCollectionLimit check prevents further growth. For standard List implementations this is safe, as an out-of-range get() throws IndexOutOfBoundsExcep…
cve-2026-47893 - LOW - Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason.
cve-2026-59276 - MEDIUM - Timing Attack via Non-Constant-Time Comparison of Sensitive Values
Several components in Spring Security compare security-sensitive values using standard string equality ( String.equals() ) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. An attacker capable of submitting a very large number of guesses and precisely measuring response latency could, in principle, use these timing differences to recover the expected value one character at a time. The affected comparison…
cve-2026-59281 - MEDIUM - Spring Framework Cross-site Scripting via EscapedErrors
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.
cve-2026-59278 - MEDIUM - In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Jackson's built-in InetAddress deserialization calls InetAddress.getByName() , which immediately triggers a DNS resolution, enabling Server-Side Request Forgery (SSRF) in the default configuration.
cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification
Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. The internal address classification did not recognize the IPv4 and IPv6 "any local" addresses ( 0.0.0.0 and :: ) as internal. As a result, matchExternal() incorrectly classified these addresses as external, and matchInternal() failed to classify them as internal. Your application may be affected if the following are true: You use InetAddressMatchers.match…
cve-2026-59275 - MEDIUM - Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)) , not just the listener thread — full availability loss for every workload co-located in that process.
cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is sending view fragments to clients over Server Sent Events (SSE) the attacker must have control over data that will be streamed to other users of the application When all the conditions above are met, the attacker might corrupt the stream of data sent to other users. Depending on the frontend application logic, thi…
cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.
cve-2026-59274 - MEDIUM - Unbounded decompression in UnZipTransformer enables zip-bomb DoS
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage.
cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
Spring Security's embedded UnboundID LDAP server ( UnboundIdContainer ) unconditionally registers an administrative credential and binds its listener to all available network interfaces. An attacker who could reach the LDAP listener port could authenticate using the well-known administrative bind DN, and then read or modify entries in the in-memory directory. Preconditions : The application uses UnboundIdContainer — configured directly or through Spring Boot auto-configuration ( spring.ldap.embedded.* properties). The LDAP listener port is reachable from the attacker's network position (not r…
cve-2026-59271 - MEDIUM - Admin password disclosed in BrokerNotAliveException message
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. If a CI pipeline sets RABBITMQ_TEST_ADMIN_PASSWORD to a real credential and the broker is required ( RABBITMQ_SERVER_REQUIRED=true ), the password is printed into test output / CI logs where anyone with log-read access can harvest it.
cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path.
cve-2026-47892 - MEDIUM - Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.
cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.
cve-2026-47881 - MEDIUM - Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. This issue affects applications that use DefaultRecordSeparatorPolicy or JsonRecordSeparatorPolicy . The default policy ( SimpleRecordSeparatorPolicy ) is not affected.
cve-2026-47887 - MEDIUM - Spring Framework Open Redirect in UrlFileNameViewController
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect.
cve-2026-47886 - MEDIUM - Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions
Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator ( ^ ) is used with a BigDecimal or BigInteger operand and a large exponent value. Evaluation of such an expression can consume excessive CPU time and JVM heap memory, leading to application degradation or unavailability. More precisely, an application can be vulnerable when all the following are true: The application accepts and evaluates untrusted or user-controlled SpEL expressions. A BigDecimal or BigInteger value is accessible…
cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. PartEventHttpMessageReader is used when controller a method has an @RequestBody Flux<PartEvent> argument.
cve-2026-47884 - MEDIUM - Spring Framework Improper Path Limitation in XsltView
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified.
cve-2026-47883 - MEDIUM - Spring Framework Open Redirect in UrlHandlerFilter
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.
cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names
A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel , errorChannel , or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders . Downstream framework code ( AbstractMessageProducingHandler.sendOutput , MessagePublishingErrorHandler.resolveErrorChannel ) resolves a String replyChannel / errorChannel header to a Spring bean via BeanFactoryChannelResolver , allowing the attacker to redirect handler output or error messages to any MessageChannel bean in the applicatio…
cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC
Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor.
cve-2026-47877 - HIGH - Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage , an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Applications that use a custom consent page (configured via OAuth2AuthorizationServerConfigurer.authorizationEndpoint(c -> c.consentPage(...)) ) are not affected.
cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
DefaultExecutionContextSerializer , used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. This issue is in the same class as CVE-2020-5411 , which addressed unsafe deserialization in Jackson2ExecutionContextStringSerializer . The MongoDB backend and ResourcelessJobRepository are not affected.
cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory.
cve-2026-47861 - MEDIUM - UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false
An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. This enables blind UDP SSRF (port scanning of internal networks via ICMP/behavior timing, triggering UDP services such as memcached/SNMP/NTP on internal hosts, or using the server as a reflection hop). The attacker controls both host and port; the payload is a 36-byte UUID string.
cve-2026-47864 - MEDIUM - Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject() . If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution. This is a classic unsafe Java deserialization flaw (CWE-502).
cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush
In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. A race condition exists between the flushing of buffered items and the arrival of new items from upstream. If new items arrive precisely during an active flush, the internal state can become corrupted, leaving items in the buffer indefinitely without scheduling a timeout. This causes the stream to permanently hang and stop processing elements. An attacker could exploit this by manipulating upstream delivery rates to trigger the race condit…
cve-2026-47862 - MEDIUM - ZipTransformer uses file_name header to build workDirectory path without sanitization
An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory.
cve-2026-47856 - MEDIUM - JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list
Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. When the header originates from an external producer (it is mapped from the inbound transport, e.g. AMQP/Kafka, into the message), an attacker controls which class the framework loads and which type the JSON payload is bound into.
cve-2026-47859 - MEDIUM - Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
RFC6587SyslogDeserializer , used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. A client that can deliver frames to the listener can declare an arbitrarily large frame length and force the server into a huge heap allocation, leading to memory exhaustion and denial of service. The non-transparent (LF-delimited) framing path is not affected: it delegates to ByteArrayLfSerializer , which enforces maxMessageSize (default…
cve-2026-47860 - MEDIUM - Unbounded decompression of attacker-supplied compressed message bodies
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. The default JavaLangErrorHandler calls System.exit(99) on OutOfMemoryError, so the entire application terminates; combined with redelivery on restart, one poison message can crash-loop the service until an operator manually purges it.
cve-2026-47852 - HIGH - Predictable cache directory location allows local ONNX model substitution in Spring AI
A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.
cve-2026-47857 - MEDIUM - Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. If a stream remains active for an extended period and experiences specific downstream backpressure conditions, an internal state tracking flaw can be triggered. This causes the stream to permanently hang and stop processing elements without raising an error. An attacker could exploit this by maintaining long-lived connections and manipulating read speeds, potentially leading to resource exhaustion and a denial of service.
cve-2026-47848 - MEDIUM - Reactor Netty WebSocket Client Leaks Credentials On Redirect
In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
cve-2026-47844 - MEDIUM - Reactor Netty HTTP Server Leaks Exception Details
In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for this to happen, the server must be configured with Brave Tracing.
cve-2026-47849 - HIGH - Spring Data REST allows mutation of identifier and version properties via JSON Patch
Spring Data REST does not guard identifier ( @Id ) and version ( @Version ) properties against mutation via RFC 6902 JSON Patch ( application/json-patch+json ) requests. The PUT and merge-patch ( application/merge-patch+json ) code paths explicitly skip these properties during binding. The JSON Patch code path does not apply an equivalent guard, allowing an authenticated client with PATCH access to overwrite them directly. Overwriting the version property defeats optimistic-locking (lost-update) protection. Overwriting the identifier property can cause the subsequent repository save to silent…
cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.
cve-2026-47850 - MEDIUM - Spring Data REST allows mutation of the version property of immutable aggregates via PUT
Spring Data REST does not preserve the persisted version ( @Version ) property of an aggregate root when handling an HTTP PUT against an immutable target type. For mutable aggregates, the PUT merge logic explicitly retains the stored identifier and version properties, discarding any client-supplied values. For immutable aggregates — Java records, Kotlin data classes, all-args @PersistenceCreator types — or when a polymorphic ( @JsonTypeInfo ) subtype change occurs, the merge instead returns the request-body object and restores only Jackson @JsonIgnore -marked properties from storage. The vers…
cve-2026-47845 - MEDIUM - Reactor Netty HTTP Server may incorrectly evaluate proxy addresses
In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol.
cve-2026-47843 - LOW - Reactor Netty may incorrectly route traffic due to DNS resolver reuse
In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. In order for this to happen, the application must dynamically create multiple clients (such as HttpClient or TcpClient ) that rely on different custom configuration. This can lead to traffic being routed to unintended destinations.
cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated.
cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation
This is a continuation of CVE-2020-5408 . Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Because the IV is fixed, identical plaintexts always produce identical ciphertext for a given password and salt, regardless of when or how many times the value was encrypted. An attacker with read access to the encrypted data store can exploit this property to determine when two records share the same plaintext value, correlate encrypted values…
cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security compares UserVerificationRequirement using identity ( == ) when determining whether user verification is required during a WebAuthn ceremony. When HTTP sessions are serialized and deserialized, as occurs with distributed session stores (e.g., Spring Session with Redis or JDBC), the deserialized UserVerificationRequirement instance is not the same object reference as the static constant REQUIRED . The identity comparison evaluates to…