Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

Project: waffle-demo-spring-filter-jakarta

com.github.waffle.demo.jakarta:waffle-demo-spring-filter-jakarta:3.6.1-SNAPSHOT

Scan Information (show all):

Summary

Summary of Vulnerable Dependencies (click to show all)

Dependency Vulnerability IDs Package Highest Severity CVE Count Confidence Evidence Count
caffeine-3.2.4.jar pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.4   0 33
checker-qual-4.2.3.jar pkg:maven/org.checkerframework/checker-qual@4.2.3   0 44
com.github.waffle:waffle-jna-jakarta:3.6.1-SNAPSHOT pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT   0 6
com.github.waffle:waffle-spring-security6:3.6.1-SNAPSHOT pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT   0 6
commons-logging-1.4.0.jar pkg:maven/commons-logging/commons-logging@1.4.0   0 129
error_prone_annotations-2.50.0.jar pkg:maven/com.google.errorprone/error_prone_annotations@2.50.0   0 29
j2objc-annotations-3.1.jar pkg:maven/com.google.j2objc/j2objc-annotations@3.1   0 33
jakarta.servlet-api-6.1.0.jar pkg:maven/jakarta.servlet/jakarta.servlet-api@6.1.0   0 44
jna-5.19.1.jar pkg:maven/net.java.dev.jna/jna@5.19.1   0 48
jna-5.19.1.jar: jnidispatch.dll   0 2
jna-5.19.1.jar: jnidispatch.dll   0 2
jna-5.19.1.jar: jnidispatch.dll   0 2
jna-platform-5.19.1.jar pkg:maven/net.java.dev.jna/jna-platform@5.19.1   0 42
jspecify-1.0.0.jar pkg:maven/org.jspecify/jspecify@1.0.0   0 32
jsr305-3.0.2.jar pkg:maven/com.google.code.findbugs/jsr305@3.0.2   0 17
logback-core-1.6.3.jar cpe:2.3:a:qos:logback:1.6.3:*:*:*:*:*:*:* pkg:maven/ch.qos.logback/logback-core@1.6.3   0 Highest 38
micrometer-commons-1.15.12.jar pkg:maven/io.micrometer/micrometer-commons@1.15.12   0 65
micrometer-observation-1.15.12.jar pkg:maven/io.micrometer/micrometer-observation@1.15.12   0 65
slf4j-api-2.0.18.jar pkg:maven/org.slf4j/slf4j-api@2.0.18   0 29
spotbugs-annotations-4.10.4.jar pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4   0 53
spring-core-6.2.19.jar cpe:2.3:a:pivotal_software:spring_framework:6.2.19:*:*:*:*:*:*:*
cpe:2.3:a:springsource:spring_framework:6.2.19:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:6.2.19:*:*:*:*:*:*:* 		pkg:maven/org.springframework/spring-core@6.2.19 CRITICAL 17 Highest 41
spring-security-core-6.5.11.jar cpe:2.3:a:pivotal_software:spring_security:6.5.11:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:6.5.11:*:*:*:*:*:*:* 		pkg:maven/org.springframework.security/spring-security-core@6.5.11 CRITICAL 4 Highest 38
spring-security-web-6.5.11.jar: spring-security-webauthn.js   0 0

Dependencies (vulnerable)

caffeine-3.2.4.jar

Description:

A high performance caching library

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/github/ben-manes/caffeine/caffeine/3.2.4/caffeine-3.2.4.jar
MD5: 04d655feb58be297a86fa2814a1f1ef8
SHA1: c63b303adf59c733d2a96125ad6670e938a2c15d
SHA256:9d9d2cfd681fd9272ded3d27c9930db12f89f732345975aa113ebc223bbf1224
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile
caffeine-3.2.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.4   (Confidence:High)

checker-qual-4.2.3.jar

Description:

checker-qual contains annotations (type qualifiers) that a programmerwrites to specify Java code for type-checking by the Checker Framework.

License:

The MIT License: https://opensource.org/licenses/MIT
File Path: /home/runner/.m2/repository/org/checkerframework/checker-qual/4.2.3/checker-qual-4.2.3.jar
MD5: d9e63a451931be32bd29cfc3ac5674c1
SHA1: d2a10af5c8574adfe24f5e35ff56cca92af2e916
SHA256:f868f731f6e37db3e1c2140d06016477989959a2d13fc5bed9c46760cffd5ba0
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile
checker-qual-4.2.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.hazendaz.jmockit/jmockit@2.3.0

Identifiers

  • pkg:maven/org.checkerframework/checker-qual@4.2.3   (Confidence:High)

com.github.waffle:waffle-jna-jakarta:3.6.1-SNAPSHOT

Description:

WAFFLE JNA Jakarta Pakage implementation

License:

MIT https://opensource.org/licenses/MIT
File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-jna-jakarta/pom.xml

Referenced In Project/Scope: waffle-demo-spring-filter-jakarta
com.github.waffle:waffle-jna-jakarta:3.6.1-SNAPSHOT is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT   (Confidence:Highest)

com.github.waffle:waffle-spring-security6:3.6.1-SNAPSHOT

Description:

Spring Security 6 integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT
File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-security6/pom.xml

Referenced In Project/Scope: waffle-demo-spring-filter-jakarta
com.github.waffle:waffle-spring-security6:3.6.1-SNAPSHOT is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT   (Confidence:Highest)

commons-logging-1.4.0.jar

Description:

Apache Commons Logging is a thin adapter allowing configurable bridging to other,
    well-known logging systems.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-logging/commons-logging/1.4.0/commons-logging-1.4.0.jar
MD5: 954e27d33e55e587a4694d5952a0c5c6
SHA1: e8f6313365dfa0580e49c58837afc8caa9b4ce05
SHA256:d175dbd751dd782a63bde28c7a039520e971f25e84b79c19b8435edc3603e0dc
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile
commons-logging-1.4.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/commons-logging/commons-logging@1.4.0   (Confidence:High)

error_prone_annotations-2.50.0.jar

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/errorprone/error_prone_annotations/2.50.0/error_prone_annotations-2.50.0.jar
MD5: 1ded1848cfd4f5167e00824faf9c4d3b
SHA1: 74ba43e49ab1184d41634af2ef0047e82c4064b0
SHA256:4667724877f1d37a689202da191e23efa7657c62eef93ccdac406eccfe5cdd0a
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:provided
error_prone_annotations-2.50.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.google.errorprone/error_prone_annotations@2.50.0   (Confidence:High)

j2objc-annotations-3.1.jar

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/j2objc/j2objc-annotations/3.1/j2objc-annotations-3.1.jar
MD5: abe8bd3abff622b9a8b15c3a737aa741
SHA1: a892ca9507839bbdb900d64310ac98256cab992f
SHA256:84d3a150518485f8140ea99b8a985656749629f6433c92b80c75b36aba3b099b
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:provided
j2objc-annotations-3.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.google.j2objc/j2objc-annotations@3.1   (Confidence:High)

jakarta.servlet-api-6.1.0.jar

Description:

Jakarta Servlet 6.1

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/runner/.m2/repository/jakarta/servlet/jakarta.servlet-api/6.1.0/jakarta.servlet-api-6.1.0.jar
MD5: 314c930b3e40ac1abc3529c7c9942f09
SHA1: 1169a246913fe3823782af7943e7a103634867c5
SHA256:8a31f465f3593bf2351531a5c952014eb839da96a605b5825b93dd54714c48c4
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:provided
jakarta.servlet-api-6.1.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/jakarta.servlet/jakarta.servlet-api@6.1.0   (Confidence:High)

jna-5.19.1.jar

Description:

Java Native Access

License:

LGPL-2.1-or-later: https://www.gnu.org/licenses/old-licenses/lgpl-2.1
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar
MD5: cf327da3e9cf5a5d77c8a43540320929
SHA1: ca303052cd617c1af2e2c8d344c98a706fb63143
SHA256:4fb141dd8ef6b0585ffceea4bc49602fbc6312fa977e2c488794ea3e6aafecae
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile
jna-5.19.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/net.java.dev.jna/jna@5.19.1   (Confidence:High)

jna-5.19.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-aarch64/jnidispatch.dll
MD5: 302945a811fd8e21bcdd5226c73b6f74
SHA1: 6b05e299ff2b3eb3b7b7aeac44263f715693607c
SHA256:b8f98be314234cf12b5b46c29652f70c0f6abb93ae19b63d3fe2692062aa699d
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile

Identifiers

  • None

jna-5.19.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-x86-64/jnidispatch.dll
MD5: 2d2475f1f026dd54e9f3e787ae4f81da
SHA1: 27ff882ac271db547aee520b38e3ba9aa91e136c
SHA256:5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile

Identifiers

  • None

jna-5.19.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-x86/jnidispatch.dll
MD5: 0caa1ef75a807f9dde05084fa2219a5c
SHA1: 2f5e1cd82cde192905c7510ce99037b67d980640
SHA256:752d597cee7e95cb517327146bf42f124c0d6c0bc48b3ecc3b1b3b0531a52f44
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile

Identifiers

  • None

jna-platform-5.19.1.jar

Description:

Java Native Access Platform

License:

LGPL-2.1-or-later: https://www.gnu.org/licenses/old-licenses/lgpl-2.1
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/net/java/dev/jna/jna-platform/5.19.1/jna-platform-5.19.1.jar
MD5: 1d97b6103a9b3b7ddb671908683f4566
SHA1: d1e54d9231da5ca3fa730d52960deaa555475468
SHA256:3b3864f5b449e9c3c24b16861524b622b086563f44e0cd8384c8efc5a6052f82
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile
jna-platform-5.19.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/net.java.dev.jna/jna-platform@5.19.1   (Confidence:High)

jspecify-1.0.0.jar

Description:

An artifact of well-named and well-specified annotations to power static analysis checks

License:

The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar
MD5: 9133aba420d0ca3b001dbb6ae9992cf6
SHA1: 7425a601c1c7ec76645a78d22b8c6a627edee507
SHA256:1fad6e6be7557781e4d33729d49ae1cdc8fdda6fe477bb0cc68ce351eafdfbab
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile
jspecify-1.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.junit.jupiter/junit-jupiter-engine@6.1.3

Identifiers

  • pkg:maven/org.jspecify/jspecify@1.0.0   (Confidence:High)

jsr305-3.0.2.jar

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:provided
jsr305-3.0.2.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4

Identifiers

  • pkg:maven/com.google.code.findbugs/jsr305@3.0.2   (Confidence:High)

logback-core-1.6.3.jar

Description:

logback-core module

License:

https://www.eclipse.org/legal/epl-v20.html, https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
File Path: /home/runner/.m2/repository/ch/qos/logback/logback-core/1.6.3/logback-core-1.6.3.jar
MD5: 6d741138bccf87bb512572c44cc7f43f
SHA1: ae9a279c723035307735fc4daf527a9076ea3f77
SHA256:a6967a28c8b086dee75a694d2f6fb8830c71153539866d7d8af065c9b6df91e0
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile
logback-core-1.6.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/ch.qos.logback/logback-classic@1.6.3

Identifiers

micrometer-commons-1.15.12.jar

Description:

Module containing common code

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/io/micrometer/micrometer-commons/1.15.12/micrometer-commons-1.15.12.jar
MD5: 8172f342d797138ec7a1a20e0332568c
SHA1: eb539638d48571fa6ce4ea3eb8417cab37a63438
SHA256:4b779cf7acb0534bb1f8e964f25200037ecb3944368f859a630fa637d6d5d7c0
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile
micrometer-commons-1.15.12.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/io.micrometer/micrometer-commons@1.15.12   (Confidence:High)

micrometer-observation-1.15.12.jar

Description:

Module containing Observation related code

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/io/micrometer/micrometer-observation/1.15.12/micrometer-observation-1.15.12.jar
MD5: b6ea6ebf93debb874d7c10f3ae79a471
SHA1: 1d96fcaec8d2516236dfcb9914108e14bfd02238
SHA256:54483e68ed44af1bb0c36d1df2235d36f233e459d52f5a3be3e69813827a6300
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile
micrometer-observation-1.15.12.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/io.micrometer/micrometer-observation@1.15.12   (Confidence:High)

slf4j-api-2.0.18.jar

Description:

The slf4j API

License:

https://opensource.org/license/mit
File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/2.0.18/slf4j-api-2.0.18.jar
MD5: fe2837bd49bfb76657419002fed20ca9
SHA1: 78a9e7a37cd6360e0b818e86341b24123d28d4df
SHA256:44508fd1576500688c790b190acdd16fec4f8c79a3e0b900afd70503cf055f55
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile
slf4j-api-2.0.18.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/ch.qos.logback/logback-classic@1.6.3

Identifiers

  • pkg:maven/org.slf4j/slf4j-api@2.0.18   (Confidence:High)

spotbugs-annotations-4.10.4.jar

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html
File Path: /home/runner/.m2/repository/com/github/spotbugs/spotbugs-annotations/4.10.4/spotbugs-annotations-4.10.4.jar
MD5: 472925cb4e5451c8f7a1aeeefe286622
SHA1: 7eb4c58212378becfb6ea6d236ec24a2352a316e
SHA256:28fa4befaddce5d7b79b07c68e7c12fa27c5d9282c4229528717971606661ea3
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:provided
spotbugs-annotations-4.10.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle.demo.jakarta/waffle-demo-spring-filter-jakarta@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4   (Confidence:High)

spring-core-6.2.19.jar

Description:

Spring Core

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /home/runner/.m2/repository/org/springframework/spring-core/6.2.19/spring-core-6.2.19.jar
MD5: 4afe3968028c2b743dbff2d79013e144
SHA1: 691459d4644894dae8e5c2d9550a4cfb8302f62f
SHA256:52146689e71a911c92bac26677d73c692512a739893a57710cc233591756bff6
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile
spring-core-6.2.19.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

CVE-2026-47884  

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47890  

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47891  

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47892  

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE
CWE-863 Incorrect Authorization

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59313  

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59283  

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-913 Improper Control of Dynamically-Managed Code Resources

CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47885  

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47886  

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-400 Uncontrolled Resource Consumption

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47888  

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE
CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47889  

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
CWE-1275 Sensitive Cookie with Improper SameSite Attribute

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47893  

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-209 Generation of Error Message Containing Sensitive Information

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59282  

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-400 Uncontrolled Resource Consumption

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47883  

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47887  

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59281  

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59280  

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:
  • Base Score: MEDIUM (4.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59314  

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
NVD-CWE-Other, CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CVSSv3:
  • Base Score: LOW (3.7)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

spring-security-core-6.5.11.jar

Description:

Spring Security

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-core/6.5.11/spring-security-core-6.5.11.jar
MD5: 697081575fdb870e6c77e4f489acb192
SHA1: d57309ff65d122a2fa45a3a8f47b01e9183cb6e6
SHA256:26ac26527cc015c5c71f3832add705a2410129a8f8de847054f2bc3b1d2e4465
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile
spring-security-core-6.5.11.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

CVE-2026-59270  

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
CWE-863 Incorrect Authorization

CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47841  

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
CWE-863 Incorrect Authorization

CVSSv3:
  • Base Score: HIGH (7.4)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47842  

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
CWE-326 Inadequate Encryption Strength

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59276  

Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
CWE-208 Observable Timing Discrepancy

CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

spring-security-web-6.5.11.jar: spring-security-webauthn.js

File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-web/6.5.11/spring-security-web-6.5.11.jar/org/springframework/security/spring-security-webauthn.js
MD5: d8d90d854a23d021c2e758b3eebce213
SHA1: 7814ccd3adc2388f52b2658bf5fc30b457949ab6
SHA256:044a2b8d7e995bff815565678631a2d3a5cc0aa96ef8ac35cfacb579307f77a9
Referenced In Project/Scope: waffle-demo-spring-filter-jakarta:compile

Identifiers

  • None


This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype Guide OSS Index API.