Spring Security Advisoriesの情報
2 ページ目
8月20日(木)
cve-2026-47834 - MEDIUM - Spring Data JPA Sort expression validation bypass
Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. The application is vulnerable if all of the following are true: The application accepts Sort parameters from untrusted input and uses them without prior sanitization as input for native SQL repository methods. The repository method is annotated with @NativeQuery or @Query(nativeQuery=true) . The repository method allows sorting via a Sort or Pageable parameter. The underlying database accepts non ASCII characters as part of its SQL syntax. On affected databases inf…
cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
The base directory ( spring.cloud.config.server.svn.basedir ) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks.
cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
Spring Security's DPoPProofJwtDecoderFactory uses an internal cache to store the processed jti (JWT ID) claims, which is intended to protect against replay attacks by ensuring that each DPoP proof is only used once. However, this cache has a strict maximum size limit of entries. If the attacker is able to intercept a legitimate user's valid DPoP proof, they can flood the server with dummy requests to forcefully evict the legitimate jti from the cache. Once the jti is evicted, the attacker can successfully replay the intercepted valid DPoP proof, leading to unauthorized access and impersonatio…