Security Advisories

This page lists Spring advisories.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

SeverityCVE IDProjectPublishedFix Version
HIGHCVE-2026-47835Spring AIJune 12, 20262 versions
HIGHCVE-2026-41708Spring Cloud SleuthJune 11, 20261 version
HIGHCVE-2026-47825Spring Cloud GatewayJune 11, 20267 versions
HIGHCVE-2026-41862Spring StatemachineJune 11, 20263 versions
MEDIUMCVE-2026-40985Spring Web FlowJune 10, 20265 versions
HIGHCVE-2026-40987Spring IntegrationJune 10, 20267 versions
MEDIUMCVE-2026-40986Spring Web FlowJune 10, 20265 versions
MEDIUMCVE-2026-40992Spring BootJune 10, 20265 versions
HIGHCVE-2026-40994Spring Web ServicesJune 10, 20266 versions
MEDIUMCVE-2026-40995Spring Web ServicesJune 10, 20266 versions
MEDIUMCVE-2026-40996Spring Web ServicesJune 10, 20266 versions
MEDIUMCVE-2026-40997Spring Web ServicesJune 10, 20266 versions
HIGHCVE-2026-40999Spring Web ServicesJune 10, 20266 versions
LOWCVE-2026-41000Spring Web ServicesJune 10, 20266 versions
MEDIUMCVE-2026-41001Spring BootJune 10, 20267 versions
HIGHCVE-2026-40998Spring Web ServicesJune 10, 20266 versions
HIGHCVE-2026-41699Spring for GraphQLJune 10, 20265 versions
HIGHCVE-2026-41700Spring for GraphQLJune 10, 20266 versions
HIGHCVE-2026-41856Spring for GraphQLJune 10, 20266 versions
HIGHCVE-2026-40988Spring SecurityJune 09, 20268 versions
MEDIUMCVE-2026-40991Spring REST DocsJune 09, 20265 versions
HIGHCVE-2026-40993Spring SecurityJune 09, 20262 versions
LOWCVE-2026-41694Spring SecurityJune 09, 20268 versions
HIGHCVE-2026-41695Spring Data CommonsJune 09, 20265 versions
MEDIUMCVE-2026-41696Spring Data MongoDBJune 09, 20267 versions

Read the original on spring.io ↗