Improper Neutralization of Input During Web Page Generation in Spring Framework

Spring Framework Unsafe Deserialization via Jackson JMS Converters

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Spring Framework vulnerable to denial of service

Spring Framework Denial of Service via Unbounded Cache in SpEL

Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL

Missing XML Validation in Spring Framework

Spring Framework vulnerable to denial of service

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE

Cross-Site Request Forgery in Spring Framework

Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

Spring Framework Algorithmic Denial of Service via SpEL Expressions

Spring Framework server Web DoS Vulnerability

Spring Framework Predictable Session ID in WebSocket Module

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Files or Directories Accessible to External Parties in org.springframework:spring-core