Spring Framework — универсальный фреймворк с открытым исходным кодом для Java-платформы.

Spring Framework Arbitrary Method Invocation in SpEL Expressions

Spring Framework Denial of Service via AntPathMatcher

Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux

Spring Framework Algorithmic Denial of Service via SpEL Expressions

Spring Framework Server-Side Request Forgery via UriComponentsBuilder

Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Spring Framework Denial of Service via Unbounded Cache in SpEL

Spring Framework Cross-site Scripting via JSP Form Tags