Spring Framework Denial of Service via Multipart Requests in WebFlux

Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Spring Framework Server-Side Request Forgery via UriComponentsBuilder

Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux

Pivotal Spring Framework DoS Attack with XML Input

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources

Spring MVC and WebFlux has Server Sent Event stream corruption

Spring Framework Denial of Service via AntPathMatcher

Spring Framework DoS with Multipart Temp Files in WebFlux

Spring Framework vulnerable to denial of service via specially crafted SpEL expression

Allocation of Resources Without Limits or Throttling in Spring Framework

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

Pivotal Spring Framework contains unsafe Java deserialization methods

Spring Framework Escalation via Session Fixation in WebFlux

Spring Framework DataBinder Case Sensitive Match Exception

Spring Framework Improper Path Limitation with Script View Templates

Moderate severity vulnerability that affects org.springframework:spring-core