# Spring vulnerabilities Source: https://junglewise.ai/threats/vendors/spring Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/spring.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 30 vulnerabilities in Spring: 0 in the last 7 days and 19 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-71575, was published on 9 October 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before. 0 critical against 1. 4 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 19 - All time: 30 (3 critical, 0 exploited in the wild) ## About Spring Java application framework providing infrastructure for building enterprise applications. ## Latest Spring vulnerabilities - [CVE-2026-71575: Spring Security OIDC authentication freshness bypass in OidcClientCodeRequestFilter](https://junglewise.ai/threats/cve-2026-71575-the-max-age-authentication-freshness-check-in) (critical, CVSS 9.1, published 9 Oct 2026) - [CVE-2026-59320: Spring AMQP link credit exhaustion in error handler](https://junglewise.ai/threats/cve-2026-59320-spring-amqp-link-credit-exhaustion-in-error-handler) (medium, CVSS 6.5, published 27 Aug 2026) - [CVE-2026-59315: Spring Cloud Config denial of service via malicious payloads](https://junglewise.ai/threats/cve-2026-59315-spring-cloud-config-denial-of-service-via-malicious-payloads) (medium, CVSS 5.3, published 27 Aug 2026) - [CVE-2026-59307: Spring Integration JdbcMessageStore deserialization bypass](https://junglewise.ai/threats/cve-2026-59307-spring-integration-jdbcmessagestore-deserialization-bypass) (high, CVSS 8, published 27 Aug 2026) - [CVE-2026-59306: Spring Cloud Stream deserialization of untrusted types](https://junglewise.ai/threats/cve-2026-59306-spring-cloud-stream-deserialization-of-untrusted-types) (low, CVSS 3.1, published 27 Aug 2026) - [CVE-2026-59303: Spring Cloud Stream unbounded dynamic destination cache](https://junglewise.ai/threats/cve-2026-59303-spring-cloud-stream-unbounded-dynamic-destination-cache) (low, CVSS 3.1, published 27 Aug 2026) - [CVE-2026-59299: Spring Cloud Function composition lookup function poisoning](https://junglewise.ai/threats/cve-2026-59299-spring-cloud-function-composition-lookup-function-poisoning) (low, CVSS 3.1, published 27 Aug 2026) - [CVE-2026-59298: Spring Cloud Function improper HTTP header filtering](https://junglewise.ai/threats/cve-2026-59298-spring-cloud-function-improper-http-header-filtering) (low, CVSS 3.1, published 27 Aug 2026) - [CVE-2026-59297: Spring Cloud Function isSecure() implementation does not verify HTTPS scheme](https://junglewise.ai/threats/cve-2026-59297-spring-cloud-function-issecure-implementation-does-not-verify) (low, CVSS 3.1, published 27 Aug 2026) - [CVE-2026-59272: Spring AMQP TLS certificate validation bypass](https://junglewise.ai/threats/cve-2026-59272-spring-amqp-tls-certificate-validation-bypass) (medium, CVSS 6.8, published 27 Aug 2026) - [CVE-2026-59355: Spring Authorization Server open redirect via request_uri parameter](https://junglewise.ai/threats/cve-2026-59355-spring-authorization-server-open-redirect-via-request-uri) (medium, CVSS 6.1, published 27 Aug 2026) - [CVE-2026-47894: Spring Cloud Config Server path traversal in native repository](https://junglewise.ai/threats/cve-2026-47894-spring-cloud-config-server-path-traversal-in-native-repository) (medium, CVSS 4.9, published 27 Aug 2026) - [CVE-2026-47877: Spring Security Authorization Server XSS in default consent page](https://junglewise.ai/threats/cve-2026-47877-spring-security-authorization-server-xss-in-default-consent-page) (high, CVSS 8.2, published 27 Aug 2026) - [CVE-2026-47875: Spring Batch deserialization bypass in Jackson2ExecutionContextStringSerializer](https://junglewise.ai/threats/cve-2026-47875-spring-batch-deserialization-bypass-in) (medium, CVSS 5.6, published 27 Aug 2026) - [CVE-2026-47864: Spring Integration SerializingHttpMessageConverter unsafe deserialization](https://junglewise.ai/threats/cve-2026-47864-spring-integration-serializinghttpmessageconverter-unsafe) (medium, CVSS 6.4, published 27 Aug 2026) - [CVE-2026-47862: Spring Integration path traversal in ZipTransformer](https://junglewise.ai/threats/cve-2026-47862-spring-integration-path-traversal-in-ziptransformer) (medium, CVSS 5.4, published 27 Aug 2026) - [CVE-2026-47860: Spring AMQP denial of service via decompression bomb](https://junglewise.ai/threats/cve-2026-47860-spring-amqp-denial-of-service-via-decompression-bomb) (medium, CVSS 6.5, published 27 Aug 2026) - [CVE-2026-47859: Spring Integration RFC6587SyslogDeserializer denial of service](https://junglewise.ai/threats/cve-2026-47859-spring-integration-rfc6587syslogdeserializer-denial-of-service) (medium, CVSS 5.4, published 27 Aug 2026) - [CVE-2026-59323: Spring Micrometer Tracing denial of service in W3C baggage parsing](https://junglewise.ai/threats/cve-2026-59323-spring-micrometer-tracing-denial-of-service-in-w3c-baggage) (medium, CVSS 5.3, published 21 Aug 2026) - [CVE-2026-22752: Spring Security Spring Authorization Server authentication bypass](https://junglewise.ai/threats/cve-2026-22752-spring-security-spring-authorization-server-authentication-bypass) (critical, CVSS 9.6, published 16 Jul 2026) - [CVE-2026-40998: VMware Spring Web Services XXE in Jaxp13XPathTemplate](https://junglewise.ai/threats/cve-2026-40998-vmware-spring-web-services-xxe-in-jaxp13xpathtemplate) (high, CVSS 8.2, published 11 Jun 2026) - [CVE-2026-41728: VMware Spring Data REST improper access control in JSON Patch](https://junglewise.ai/threats/cve-2026-41728-vmware-spring-data-rest-improper-access-control-in-json-patch) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-41695: VMware Spring Data Commons denial of service in MappingContext](https://junglewise.ai/threats/cve-2026-41695-vmware-spring-data-commons-denial-of-service-in-mappingcontext) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-41008: VMware Spring Security Authorization Server open redirect in authorization endpoint](https://junglewise.ai/threats/cve-2026-41008-vmware-spring-security-authorization-server-open-redirect-in) (medium, CVSS 6.1, published 10 Jun 2026) - [CVE-2026-40991: VMware Spring REST Docs XXE injection in webtestclient and restassured](https://junglewise.ai/threats/cve-2026-40991-vmware-spring-rest-docs-xxe-injection-in-webtestclient-and) (medium, CVSS 5.9, published 10 Jun 2026) ## Most severe Spring vulnerabilities - [CVE-2026-22752: Spring Security Spring Authorization Server authentication bypass](https://junglewise.ai/threats/cve-2026-22752-spring-security-spring-authorization-server-authentication-bypass) (critical, CVSS 9.6, published 16 Jul 2026) - [CVE-2026-40982: VMware Spring Cloud Config directory traversal in spring-cloud-config-server](https://junglewise.ai/threats/cve-2026-40982-vmware-spring-cloud-config-directory-traversal-in-spring-cloud) (critical, CVSS 9.1, published 7 May 2026) - [CVE-2026-71575: Spring Security OIDC authentication freshness bypass in OidcClientCodeRequestFilter](https://junglewise.ai/threats/cve-2026-71575-the-max-age-authentication-freshness-check-in) (critical, CVSS 9.1, published 9 Oct 2026) - [CVE-2026-40998: VMware Spring Web Services XXE in Jaxp13XPathTemplate](https://junglewise.ai/threats/cve-2026-40998-vmware-spring-web-services-xxe-in-jaxp13xpathtemplate) (high, CVSS 8.2, published 11 Jun 2026) - [CVE-2026-47877: Spring Security Authorization Server XSS in default consent page](https://junglewise.ai/threats/cve-2026-47877-spring-security-authorization-server-xss-in-default-consent-page) (high, CVSS 8.2, published 27 Aug 2026) - [CVE-2026-59307: Spring Integration JdbcMessageStore deserialization bypass](https://junglewise.ai/threats/cve-2026-59307-spring-integration-jdbcmessagestore-deserialization-bypass) (high, CVSS 8, published 27 Aug 2026) - [CVE-2026-41695: VMware Spring Data Commons denial of service in MappingContext](https://junglewise.ai/threats/cve-2026-41695-vmware-spring-data-commons-denial-of-service-in-mappingcontext) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-41007: VMware Spring HATEOAS resource exhaustion in StringLinkRelation cache](https://junglewise.ai/threats/cve-2026-41007-vmware-spring-hateoas-resource-exhaustion-in-stringlinkrelation) (high, CVSS 7.5, published 9 Jun 2026) - [CVE-2026-41728: VMware Spring Data REST improper access control in JSON Patch](https://junglewise.ai/threats/cve-2026-41728-vmware-spring-data-rest-improper-access-control-in-json-patch) (high, CVSS 7.5, published 10 Jun 2026) - [CVE-2026-59272: Spring AMQP TLS certificate validation bypass](https://junglewise.ai/threats/cve-2026-59272-spring-amqp-tls-certificate-validation-bypass) (medium, CVSS 6.8, published 27 Aug 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 1 vulnerability in the four before. 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 17 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 1 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Spring technologies - [Spring Integration](https://junglewise.ai/threats/technologies/integration): 4 vulnerabilities - [Spring AMQP](https://junglewise.ai/threats/technologies/amqp): 3 vulnerabilities - [Spring Authorization Server](https://junglewise.ai/threats/technologies/authorization-server): 3 vulnerabilities - [Spring Cloud Function](https://junglewise.ai/threats/technologies/cloud-function): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Spring vulnerabilities", https://junglewise.ai/threats/vendors/spring, 9 November 2026.