# VMware Spring Framework vulnerabilities Source: https://junglewise.ai/threats/technologies/spring-framework Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/spring-framework.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in VMware Spring Framework: 0 in the last 7 days and 4 in the last 90 days, 3 of them critical and 1 exploited in the wild. The most recent, CVE-2026-59313, was published on 27 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 4 - All time: 26 (3 critical, 1 exploited in the wild) ## About VMware Spring Framework Java framework for building enterprise applications with dependency injection and web server capabilities. ## Latest VMware Spring Framework vulnerabilities - [CVE-2026-59313: Spring Framework stream corruption in Server-Sent Events](https://junglewise.ai/threats/cve-2026-59313-spring-framework-stream-corruption-in-server-sent-events) (critical, CVSS 9.8, published 27 Aug 2026) - [CVE-2026-47893: Spring Framework information disclosure in WebSocket exception handling](https://junglewise.ai/threats/cve-2026-47893-spring-framework-information-disclosure-in-websocket-exception) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-47891: Spring Framework XML maxInMemorySize enforcement bypass](https://junglewise.ai/threats/cve-2026-47891-spring-framework-xml-maxinmemorysize-enforcement-bypass) (critical, CVSS 9.8, published 27 Aug 2026) - [CVE-2026-47883: Spring Framework UrlHandlerFilter open redirect vulnerability](https://junglewise.ai/threats/cve-2026-47883-spring-framework-urlhandlerfilter-open-redirect-vulnerability) (medium, CVSS 6.1, published 27 Aug 2026) - [CVE-2026-41842: VMware Spring Framework denial of service in static resource resolution](https://junglewise.ai/threats/cve-2026-41842-vmware-spring-framework-dos-in-static-resource-resolution) (high, CVSS 7.5, published 9 Jun 2026) - [CVE-2026-41855: VMware Spring Framework deserialization in JMS message converters](https://junglewise.ai/threats/cve-2026-41855-vmware-spring-framework-deserialization-in-jms-message-converters) (high, CVSS 8.1, published 9 Jun 2026) - [CVE-2026-41854: VMware Spring Framework SSRF in UriComponentsBuilder](https://junglewise.ai/threats/cve-2026-41854-vmware-spring-framework-ssrf-in-uricomponentsbuilder) (medium, CVSS 4.2, published 9 Jun 2026) - [CVE-2026-41853: VMware Spring Framework multipart request smuggling in MVC and WebFlux](https://junglewise.ai/threats/cve-2026-41853-vmware-spring-framework-multipart-request-smuggling-in-mvc-and) (medium, CVSS 5.3, published 9 Jun 2026) - [CVE-2026-41852: VMware Spring Framework authorization bypass in SpEL](https://junglewise.ai/threats/cve-2026-41852-vmware-spring-framework-authorization-bypass-in-spel) (low, CVSS 3.7, published 9 Jun 2026) - [CVE-2026-41851: VMware Spring Framework denial of service in SpEL expression evaluation](https://junglewise.ai/threats/cve-2026-41851-vmware-spring-framework-denial-of-service-in-spel-expression) (medium, CVSS 5.3, published 9 Jun 2026) - [CVE-2026-41850: VMware Spring Framework Algorithmic DoS in SpEL evaluation](https://junglewise.ai/threats/cve-2026-41850-vmware-spring-framework-algorithmic-dos-in-spel-evaluation) (high, CVSS 7.5, published 9 Jun 2026) - [CVE-2026-41849: VMware Spring Framework integer overflow in SpEL evaluation](https://junglewise.ai/threats/cve-2026-41849-vmware-spring-framework-integer-overflow-in-spel-evaluation) (high, CVSS 7.5, published 9 Jun 2026) - [CVE-2026-41848: VMware Spring Framework ReDoS in AntPathMatcher](https://junglewise.ai/threats/cve-2026-41848-vmware-spring-framework-redos-in-antpathmatcher) (low, CVSS 3.7, published 9 Jun 2026) - [CVE-2026-41847: VMware Spring Framework security bypass in WebFlux Kotlin Router DSL](https://junglewise.ai/threats/cve-2026-41847-vmware-spring-framework-security-bypass-in-webflux-kotlin-router) (medium, CVSS 4.8, published 9 Jun 2026) - [CVE-2026-41846: VMware Spring Framework XSS in JSP form tags](https://junglewise.ai/threats/cve-2026-41846-vmware-spring-framework-xss-in-jsp-form-tags) (medium, CVSS 5.9, published 9 Jun 2026) - [CVE-2026-41845: VMware Spring Framework XSS in JavaScriptUtils](https://junglewise.ai/threats/cve-2026-41845-vmware-spring-framework-xss-in-javascriptutils) (high, CVSS 7.1, published 9 Jun 2026) - [CVE-2026-41844: VMware Spring Framework open redirect in MVC and WebFlux](https://junglewise.ai/threats/cve-2026-41844-vmware-spring-framework-open-redirect-in-mvc-and-webflux) (medium, CVSS 4.2, published 9 Jun 2026) - [CVE-2026-41843: VMware Spring Framework path traversal in static resource resolution](https://junglewise.ai/threats/cve-2026-41843-vmware-spring-framework-path-traversal-in-static-resource) (medium, CVSS 5.9, published 9 Jun 2026) - [CVE-2026-41841: VMware Spring Framework information disclosure in static resource resolution](https://junglewise.ai/threats/cve-2026-41841-vmware-spring-framework-information-disclosure-in-static-resource) (medium, CVSS 5.9, published 9 Jun 2026) - [CVE-2026-41840: VMware Spring Framework DoS in WebFlux multipart processing](https://junglewise.ai/threats/cve-2026-41840-vmware-spring-framework-dos-in-webflux-multipart-processing) (medium, CVSS 5.9, published 9 Jun 2026) - [CVE-2026-41839: VMware Spring Framework session fixation in WebFlux](https://junglewise.ai/threats/cve-2026-41839-vmware-spring-framework-session-fixation-in-webflux) (medium, CVSS 4.2, published 9 Jun 2026) - [CVE-2026-41838: VMware Spring Framework predictable WebSocket session IDs](https://junglewise.ai/threats/cve-2026-41838-vmware-spring-framework-predictable-websocket-session-ids) (medium, CVSS 4.8, published 9 Jun 2026) - [CVE-2026-22745: Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources](https://junglewise.ai/threats/cve-2026-22745-spring-mvc-and-webflux-applications-are-vulnerable-to-denial-of) (medium, CVSS 5.3, published 29 Apr 2026) - [CVE-2026-22741: Spring Framework cache poisoning in static resource resolution](https://junglewise.ai/threats/cve-2026-22741-spring-framework-cache-poisoning-in-static-resource-resolution) (low, CVSS 3.1, published 29 Apr 2026) - [CVE-2026-22740: Spring Framework denial of service in WebFlux multipart handling](https://junglewise.ai/threats/cve-2026-22740-spring-framework-denial-of-service-in-webflux-multipart-handling) (medium, CVSS 6.5, published 29 Apr 2026) ## Most severe VMware Spring Framework vulnerabilities - [CVE-2022-22965: Remote Code Execution in Spring Framework](https://junglewise.ai/threats/cve-2022-22965-spring-framework-jdk-9-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 31 Mar 2022) - [CVE-2026-59313: Spring Framework stream corruption in Server-Sent Events](https://junglewise.ai/threats/cve-2026-59313-spring-framework-stream-corruption-in-server-sent-events) (critical, CVSS 9.8, published 27 Aug 2026) - [CVE-2026-47891: Spring Framework XML maxInMemorySize enforcement bypass](https://junglewise.ai/threats/cve-2026-47891-spring-framework-xml-maxinmemorysize-enforcement-bypass) (critical, CVSS 9.8, published 27 Aug 2026) - [CVE-2026-41855: VMware Spring Framework deserialization in JMS message converters](https://junglewise.ai/threats/cve-2026-41855-vmware-spring-framework-deserialization-in-jms-message-converters) (high, CVSS 8.1, published 9 Jun 2026) - [CVE-2026-41842: VMware Spring Framework denial of service in static resource resolution](https://junglewise.ai/threats/cve-2026-41842-vmware-spring-framework-dos-in-static-resource-resolution) (high, CVSS 7.5, published 9 Jun 2026) - [CVE-2026-41850: VMware Spring Framework Algorithmic DoS in SpEL evaluation](https://junglewise.ai/threats/cve-2026-41850-vmware-spring-framework-algorithmic-dos-in-spel-evaluation) (high, CVSS 7.5, published 9 Jun 2026) - [CVE-2026-41849: VMware Spring Framework integer overflow in SpEL evaluation](https://junglewise.ai/threats/cve-2026-41849-vmware-spring-framework-integer-overflow-in-spel-evaluation) (high, CVSS 7.5, published 9 Jun 2026) - [CVE-2026-47893: Spring Framework information disclosure in WebSocket exception handling](https://junglewise.ai/threats/cve-2026-47893-spring-framework-information-disclosure-in-websocket-exception) (high, CVSS 7.5, published 27 Aug 2026) - [CVE-2026-41845: VMware Spring Framework XSS in JavaScriptUtils](https://junglewise.ai/threats/cve-2026-41845-vmware-spring-framework-xss-in-javascriptutils) (high, CVSS 7.1, published 9 Jun 2026) - [CVE-2026-22740: Spring Framework denial of service in WebFlux multipart handling](https://junglewise.ai/threats/cve-2026-22740-spring-framework-denial-of-service-in-webflux-multipart-handling) (medium, CVSS 6.5, published 29 Apr 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 4 | 2 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other VMware technologies - [VMware RabbitMQ](https://junglewise.ai/threats/technologies/vmware-rabbitmq): 30 vulnerabilities - [VMware Cloud Foundation](https://junglewise.ai/threats/technologies/cloud-foundation): 21 vulnerabilities - [VMware Spring AI](https://junglewise.ai/threats/technologies/spring-ai): 20 vulnerabilities - [VMware Spring Security](https://junglewise.ai/threats/technologies/spring-security): 19 vulnerabilities - [VMware ESXi](https://junglewise.ai/threats/technologies/esxi): 11 vulnerabilities - [VMware Spring Boot](https://junglewise.ai/threats/technologies/spring-boot): 11 vulnerabilities - [VMware Fusion](https://junglewise.ai/threats/technologies/fusion): 8 vulnerabilities - [VMware Avi Load Balancer](https://junglewise.ai/threats/technologies/avi-load-balancer): 7 vulnerabilities - [VMware Spring for GraphQL](https://junglewise.ai/threats/technologies/spring-for-graphql): 7 vulnerabilities - [VMware Spring Integration](https://junglewise.ai/threats/technologies/spring-integration): 7 vulnerabilities - [VMware vSphere Foundation](https://junglewise.ai/threats/technologies/vsphere-foundation): 7 vulnerabilities - [VMware Spring Web Services](https://junglewise.ai/threats/technologies/web-services): 7 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "VMware Spring Framework vulnerabilities", https://junglewise.ai/threats/technologies/spring-framework, 9 November 2026.