脆弱性・アップデート

Oracle Java の脆弱性対策について(2026年10月)

Start Your Next KMP App With Kotlin Toolchain 0.13

The Kotlin Toolchain is a unified entry point into Kotlin. It lets you build JVM, Android, iOS, multiplatform, and server-side applications with a simple declarative configuration. With the release of v0.13, we now recommend the Kotlin Toolchain for most new Kotlin Multiplatform (KMP) projects. Earlier this year, we promoted the Kotlin Toolchain to Alpha. Since […]

cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader . Under these conditions, a view name containing backslash sequences can escape the configured template directory, potentially exposing files that should not be accessible. Returning a view name derived from untrusted input is an application-level anti-pattern that Spring documentation warns against; applications that do not do so are not affect…

cve-2026-59272 - MEDIUM - Log4j2 AmqpAppender disables TLS hostname verification by default

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Attackers on the network path can read or alter log traffic (often containing tokens, PII, or stack traces with secrets) without certificate errors. The docs promise hostname verification is on by default, so operators have no reason to suspect exposure.

cve-2026-59282 - MEDIUM - Spring Framework Denial of Service via Unbounded List Growth in Data Binding

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack. Spring Framework's property binding infrastructure traverses nested property paths by calling list.get(index) to navigate into list elements. This call is made without verifying that the index falls within the list's current bounds after the configured autoGrowCollectionLimit check prevents further growth. For standard List implementations this is safe, as an out-of-range get() throws IndexOutOfBoundsExcep…

cve-2026-47893 - LOW - Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason.

cve-2026-59276 - MEDIUM - Timing Attack via Non-Constant-Time Comparison of Sensitive Values

Several components in Spring Security compare security-sensitive values using standard string equality ( String.equals() ) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. An attacker capable of submitting a very large number of guesses and precisely measuring response latency could, in principle, use these timing differences to recover the expected value one character at a time. The affected comparison…

cve-2026-59281 - MEDIUM - Spring Framework Cross-site Scripting via EscapedErrors

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.

cve-2026-59278 - MEDIUM - In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Jackson's built-in InetAddress deserialization calls InetAddress.getByName() , which immediately triggers a DNS resolution, enabling Server-Side Request Forgery (SSRF) in the default configuration.

cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification

Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network. The internal address classification did not recognize the IPv4 and IPv6 "any local" addresses ( 0.0.0.0 and :: ) as internal. As a result, matchExternal() incorrectly classified these addresses as external, and matchInternal() failed to classify them as internal. Your application may be affected if the following are true: You use InetAddressMatchers.match…

cve-2026-59275 - MEDIUM - Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)) , not just the listener thread — full availability loss for every workload co-located in that process.

cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is sending view fragments to clients over Server Sent Events (SSE) the attacker must have control over data that will be streamed to other users of the application When all the conditions above are met, the attacker might corrupt the stream of data sent to other users. Depending on the frontend application logic, thi…

cve-2026-47888 - MEDIUM - Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.

cve-2026-59274 - MEDIUM - Unbounded decompression in UnZipTransformer enables zip-bomb DoS

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage.

cve-2026-59271 - MEDIUM - Admin password disclosed in BrokerNotAliveException message

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. If a CI pipeline sets RABBITMQ_TEST_ADMIN_PASSWORD to a real credential and the broker is required ( RABBITMQ_SERVER_REQUIRED=true ), the password is printed into test output / CI logs where anyone with log-read access can harvest it.

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path.

cve-2026-47892 - MEDIUM - Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.

cve-2026-47891 - MEDIUM - Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.

cve-2026-47881 - MEDIUM - Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory. This issue affects applications that use DefaultRecordSeparatorPolicy or JsonRecordSeparatorPolicy . The default policy ( SimpleRecordSeparatorPolicy ) is not affected.

cve-2026-47887 - MEDIUM - Spring Framework Open Redirect in UrlFileNameViewController

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect.

cve-2026-47886 - MEDIUM - Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator ( ^ ) is used with a BigDecimal or BigInteger operand and a large exponent value. Evaluation of such an expression can consume excessive CPU time and JVM heap memory, leading to application degradation or unavailability. More precisely, an application can be vulnerable when all the following are true: The application accepts and evaluates untrusted or user-controlled SpEL expressions. A BigDecimal or BigInteger value is accessible…

cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. PartEventHttpMessageReader is used when controller a method has an @RequestBody Flux<PartEvent> argument.

cve-2026-47884 - MEDIUM - Spring Framework Improper Path Limitation in XsltView

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified.

cve-2026-47883 - MEDIUM - Spring Framework Open Redirect in UrlHandlerFilter

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.

cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.

cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel , errorChannel , or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders . Downstream framework code ( AbstractMessageProducingHandler.sendOutput , MessagePublishingErrorHandler.resolveErrorChannel ) resolves a String replyChannel / errorChannel header to a Spring bean via BeanFactoryChannelResolver , allowing the attacker to redirect handler output or error messages to any MessageChannel bean in the applicatio…

cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist

DefaultExecutionContextSerializer , used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist. This issue is in the same class as CVE-2020-5411 , which addressed unsafe deserialization in Jackson2ExecutionContextStringSerializer . The MongoDB backend and ResourcelessJobRepository are not affected.

cve-2026-47874 - MEDIUM - Reactor Netty HTTP Server Denial of Service With Pipelined Requests

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory.

cve-2026-47861 - MEDIUM - UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. This enables blind UDP SSRF (port scanning of internal networks via ICMP/behavior timing, triggering UDP services such as memcached/SNMP/NTP on internal hosts, or using the server as a reflection hop). The attacker controls both host and port; the payload is a 36-byte UUID string.

cve-2026-47864 - MEDIUM - Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject() . If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution. This is a classic unsafe Java deserialization flaw (CWE-502).

cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. A race condition exists between the flushing of buffered items and the arrival of new items from upstream. If new items arrive precisely during an active flush, the internal state can become corrupted, leaving items in the buffer indefinitely without scheduling a timeout. This causes the stream to permanently hang and stop processing elements. An attacker could exploit this by manipulating upstream delivery rates to trigger the race condit…

cve-2026-47862 - MEDIUM - ZipTransformer uses file_name header to build workDirectory path without sanitization

An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory.

cve-2026-47856 - MEDIUM - JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. When the header originates from an external producer (it is mapped from the inbound transport, e.g. AMQP/Kafka, into the message), an attacker controls which class the framework loads and which type the JSON payload is bound into.

cve-2026-47859 - MEDIUM - Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

RFC6587SyslogDeserializer , used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. A client that can deliver frames to the listener can declare an arbitrarily large frame length and force the server into a huge heap allocation, leading to memory exhaustion and denial of service. The non-transparent (LF-delimited) framing path is not affected: it delegates to ByteArrayLfSerializer , which enforces maxMessageSize (default…

cve-2026-47860 - MEDIUM - Unbounded decompression of attacker-supplied compressed message bodies

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. The default JavaLangErrorHandler calls System.exit(99) on OutOfMemoryError, so the entire application terminates; combined with redelivery on restart, one poison message can crash-loop the service until an operator manually purges it.

cve-2026-47857 - MEDIUM - Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. If a stream remains active for an extended period and experiences specific downstream backpressure conditions, an internal state tracking flaw can be triggered. This causes the stream to permanently hang and stop processing elements without raising an error. An attacker could exploit this by maintaining long-lived connections and manipulating read speeds, potentially leading to resource exhaustion and a denial of service.