Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

Project: waffle-spring-boot-autoconfigure3

com.github.waffle:waffle-spring-boot-autoconfigure3:3.6.1-SNAPSHOT

Scan Information (show all):

Summary

Summary of Vulnerable Dependencies (click to show all)

Dependency Vulnerability IDs Package Highest Severity CVE Count Confidence Evidence Count
caffeine-3.2.4.jar pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.4   0 33
checker-qual-4.2.3.jar pkg:maven/org.checkerframework/checker-qual@4.2.3   0 44
com.github.waffle:waffle-jna-jakarta:3.6.1-SNAPSHOT pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT   0 6
com.github.waffle:waffle-spring-security6:3.6.1-SNAPSHOT pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT   0 6
commons-logging-1.4.0.jar pkg:maven/commons-logging/commons-logging@1.4.0   0 129
error_prone_annotations-2.50.0.jar pkg:maven/com.google.errorprone/error_prone_annotations@2.50.0   0 29
j2objc-annotations-3.1.jar pkg:maven/com.google.j2objc/j2objc-annotations@3.1   0 33
jackson-annotations-2.21.jar cpe:2.3:a:fasterxml:jackson-core:2.21:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-modules-java8:2.21:*:*:*:*:*:*:* 		pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.21   0 Highest 36
jackson-core-2.21.4.jar cpe:2.3:a:fasterxml:jackson-core:2.21.4:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-modules-java8:2.21.4:*:*:*:*:*:*:* 		pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4   0 Highest 47
jackson-databind-2.21.4.jar cpe:2.3:a:fasterxml:jackson-core:2.21.4:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-databind:2.21.4:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:jackson-modules-java8:2.21.4:*:*:*:*:*:*:* 		pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4 MEDIUM 1 Highest 41
jackson-datatype-jdk8-2.21.4.jar cpe:2.3:a:fasterxml:jackson-modules-java8:2.21.4:*:*:*:*:*:*:* pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jdk8@2.21.4   0 Low 39
jakarta.annotation-api-2.1.1.jar pkg:maven/jakarta.annotation/jakarta.annotation-api@2.1.1   0 42
jna-5.19.1.jar pkg:maven/net.java.dev.jna/jna@5.19.1   0 48
jna-5.19.1.jar: jnidispatch.dll   0 2
jna-5.19.1.jar: jnidispatch.dll   0 2
jna-5.19.1.jar: jnidispatch.dll   0 2
jna-platform-5.19.1.jar pkg:maven/net.java.dev.jna/jna-platform@5.19.1   0 42
jspecify-1.0.0.jar pkg:maven/org.jspecify/jspecify@1.0.0   0 32
jsr305-3.0.2.jar pkg:maven/com.google.code.findbugs/jsr305@3.0.2   0 17
jul-to-slf4j-2.0.18.jar pkg:maven/org.slf4j/jul-to-slf4j@2.0.18   0 31
log4j-api-2.26.1.jar cpe:2.3:a:apache:log4j:2.26.1:*:*:*:*:*:*:* pkg:maven/org.apache.logging.log4j/log4j-api@2.26.1   0 Highest 43
logback-core-1.5.34.jar cpe:2.3:a:qos:logback:1.5.34:*:*:*:*:*:*:* pkg:maven/ch.qos.logback/logback-core@1.5.34   0 Highest 39
micrometer-commons-1.15.12.jar pkg:maven/io.micrometer/micrometer-commons@1.15.12   0 65
micrometer-observation-1.15.12.jar pkg:maven/io.micrometer/micrometer-observation@1.15.12   0 65
slf4j-api-2.0.18.jar pkg:maven/org.slf4j/slf4j-api@2.0.18   0 29
snakeyaml-2.4.jar cpe:2.3:a:snakeyaml_project:snakeyaml:2.4:*:*:*:*:*:*:* pkg:maven/org.yaml/snakeyaml@2.4   0 Highest 42
spotbugs-annotations-4.10.4.jar pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4   0 53
spring-boot-3.5.16.jar cpe:2.3:a:vmware:spring_boot:3.5.16:*:*:*:*:*:*:* pkg:maven/org.springframework.boot/spring-boot@3.5.16   0 Highest 38
spring-core-6.2.19.jar cpe:2.3:a:pivotal_software:spring_framework:6.2.19:*:*:*:*:*:*:*
cpe:2.3:a:springsource:spring_framework:6.2.19:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_framework:6.2.19:*:*:*:*:*:*:* 		pkg:maven/org.springframework/spring-core@6.2.19 CRITICAL 17 Highest 41
spring-security-core-6.5.11.jar cpe:2.3:a:pivotal_software:spring_security:6.5.11:*:*:*:*:*:*:*
cpe:2.3:a:vmware:spring_security:6.5.11:*:*:*:*:*:*:* 		pkg:maven/org.springframework.security/spring-security-core@6.5.11 CRITICAL 4 Highest 38
spring-security-web-6.5.11.jar: spring-security-webauthn.js   0 0
tomcat-embed-core-10.1.55.jar cpe:2.3:a:apache:tomcat:10.1.55:*:*:*:*:*:*:*
cpe:2.3:a:apache_tomcat:apache_tomcat:10.1.55:*:*:*:*:*:*:* 		pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.55 CRITICAL 19 Highest 63
tomcat-embed-el-10.1.55.jar pkg:maven/org.apache.tomcat.embed/tomcat-embed-el@10.1.55   0 33

Dependencies (vulnerable)

caffeine-3.2.4.jar

Description:

A high performance caching library

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/github/ben-manes/caffeine/caffeine/3.2.4/caffeine-3.2.4.jar
MD5: 04d655feb58be297a86fa2814a1f1ef8
SHA1: c63b303adf59c733d2a96125ad6670e938a2c15d
SHA256:9d9d2cfd681fd9272ded3d27c9930db12f89f732345975aa113ebc223bbf1224
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
caffeine-3.2.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.ben-manes.caffeine/caffeine@3.2.4   (Confidence:High)

checker-qual-4.2.3.jar

Description:

checker-qual contains annotations (type qualifiers) that a programmerwrites to specify Java code for type-checking by the Checker Framework.

License:

The MIT License: https://opensource.org/licenses/MIT
File Path: /home/runner/.m2/repository/org/checkerframework/checker-qual/4.2.3/checker-qual-4.2.3.jar
MD5: d9e63a451931be32bd29cfc3ac5674c1
SHA1: d2a10af5c8574adfe24f5e35ff56cca92af2e916
SHA256:f868f731f6e37db3e1c2140d06016477989959a2d13fc5bed9c46760cffd5ba0
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
checker-qual-4.2.3.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.hazendaz.jmockit/jmockit@2.3.0

Identifiers

  • pkg:maven/org.checkerframework/checker-qual@4.2.3   (Confidence:High)

com.github.waffle:waffle-jna-jakarta:3.6.1-SNAPSHOT

Description:

WAFFLE JNA Jakarta Pakage implementation

License:

MIT https://opensource.org/licenses/MIT
File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-jna-jakarta/pom.xml

Referenced In Project/Scope: waffle-spring-boot-autoconfigure3
com.github.waffle:waffle-jna-jakarta:3.6.1-SNAPSHOT is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.waffle/waffle-jna-jakarta@3.6.1-SNAPSHOT   (Confidence:Highest)

com.github.waffle:waffle-spring-security6:3.6.1-SNAPSHOT

Description:

Spring Security 6 integration for WAFFLE

License:

MIT https://opensource.org/licenses/MIT
File Path: /home/runner/work/waffle/waffle/Source/JNA/waffle-spring-security6/pom.xml

Referenced In Project/Scope: waffle-spring-boot-autoconfigure3
com.github.waffle:waffle-spring-security6:3.6.1-SNAPSHOT is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT   (Confidence:Highest)

commons-logging-1.4.0.jar

Description:

Apache Commons Logging is a thin adapter allowing configurable bridging to other,
    well-known logging systems.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/commons-logging/commons-logging/1.4.0/commons-logging-1.4.0.jar
MD5: 954e27d33e55e587a4694d5952a0c5c6
SHA1: e8f6313365dfa0580e49c58837afc8caa9b4ce05
SHA256:d175dbd751dd782a63bde28c7a039520e971f25e84b79c19b8435edc3603e0dc
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
commons-logging-1.4.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/commons-logging/commons-logging@1.4.0   (Confidence:High)

error_prone_annotations-2.50.0.jar

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/errorprone/error_prone_annotations/2.50.0/error_prone_annotations-2.50.0.jar
MD5: 1ded1848cfd4f5167e00824faf9c4d3b
SHA1: 74ba43e49ab1184d41634af2ef0047e82c4064b0
SHA256:4667724877f1d37a689202da191e23efa7657c62eef93ccdac406eccfe5cdd0a
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:provided
error_prone_annotations-2.50.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.google.errorprone/error_prone_annotations@2.50.0   (Confidence:High)

j2objc-annotations-3.1.jar

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/j2objc/j2objc-annotations/3.1/j2objc-annotations-3.1.jar
MD5: abe8bd3abff622b9a8b15c3a737aa741
SHA1: a892ca9507839bbdb900d64310ac98256cab992f
SHA256:84d3a150518485f8140ea99b8a985656749629f6433c92b80c75b36aba3b099b
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:provided
j2objc-annotations-3.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.google.j2objc/j2objc-annotations@3.1   (Confidence:High)

jackson-annotations-2.21.jar

Description:

Core annotations used for value types, used by Jackson data binding package.

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-annotations/2.21/jackson-annotations-2.21.jar
MD5: e0d0c3e7300954f73e43c67d933aaea4
SHA1: b1bc1868bf02dc0bd6c7836257a036a331005309
SHA256:53ca085f4a150f703f49e1aabd935bd03b43e1ea3d55d135438292af22cef56b
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
jackson-annotations-2.21.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Identifiers

  • pkg:maven/com.fasterxml.jackson.core/jackson-annotations@2.21   (Confidence:High)
  • cpe:2.3:a:fasterxml:jackson-core:2.21:*:*:*:*:*:*:*   (Confidence:Highest)   
  • cpe:2.3:a:fasterxml:jackson-modules-java8:2.21:*:*:*:*:*:*:*   (Confidence:Low)   

jackson-core-2.21.4.jar

Description:

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.21.4/jackson-core-2.21.4.jar
MD5: 2f3d2557bb48afa00fe924c9689ab3b6
SHA1: 56a503ba45016714394807ea89f95f5093760089
SHA256:4b40a06396f239f8de2da57419adde6e94e5edc18a2171d471ea05eeed4e5c2d
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
jackson-core-2.21.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Identifiers

  • pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4   (Confidence:High)
  • cpe:2.3:a:fasterxml:jackson-core:2.21.4:*:*:*:*:*:*:*   (Confidence:Highest)   
  • cpe:2.3:a:fasterxml:jackson-modules-java8:2.21.4:*:*:*:*:*:*:*   (Confidence:Low)   

jackson-databind-2.21.4.jar

Description:

General data-binding functionality for Jackson: works on core streaming API

License:

The Apache Software License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.21.4/jackson-databind-2.21.4.jar
MD5: 99769ad660a66c43caee5d539d19ed96
SHA1: 09e495680be707d466527d734368ebf36e464da2
SHA256:3888e9e69ab66fbacaacc9aea0e9ffbf15368288e4aca468b024dba11c09fbf9
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
jackson-databind-2.21.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Identifiers

CVE-2026-54515  

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

jackson-datatype-jdk8-2.21.4.jar

Description:

Add-on module for Jackson (https://github.com/FasterXML/jackson) to support
JDK 8 data types.

License:

http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/fasterxml/jackson/datatype/jackson-datatype-jdk8/2.21.4/jackson-datatype-jdk8-2.21.4.jar
MD5: 282ec253ef93128ef2df436f02971b98
SHA1: 0a1b9fe3b6e8d4418fe09a1ba9a8f6640137cfb5
SHA256:2dde4a8f1aad3306c040f56ff40da81c6d58dcef3434c00849c9bce09f56a074
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
jackson-datatype-jdk8-2.21.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Identifiers

  • pkg:maven/com.fasterxml.jackson.datatype/jackson-datatype-jdk8@2.21.4   (Confidence:High)
  • cpe:2.3:a:fasterxml:jackson-modules-java8:2.21.4:*:*:*:*:*:*:*   (Confidence:Low)   

jakarta.annotation-api-2.1.1.jar

Description:

Jakarta Annotations API

License:

EPL 2.0: http://www.eclipse.org/legal/epl-2.0
GPL2 w/ CPE: https://www.gnu.org/software/classpath/license.html
File Path: /home/runner/.m2/repository/jakarta/annotation/jakarta.annotation-api/2.1.1/jakarta.annotation-api-2.1.1.jar
MD5: 5dac2f68e8288d0add4dc92cb161711d
SHA1: 48b9bda22b091b1f48b13af03fe36db3be6e1ae3
SHA256:5f65fdaf424eee2b55e1d882ba9bb376be93fb09b37b808be6e22e8851c909fe
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
jakarta.annotation-api-2.1.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Identifiers

  • pkg:maven/jakarta.annotation/jakarta.annotation-api@2.1.1   (Confidence:High)

jna-5.19.1.jar

Description:

Java Native Access

License:

LGPL-2.1-or-later: https://www.gnu.org/licenses/old-licenses/lgpl-2.1
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar
MD5: cf327da3e9cf5a5d77c8a43540320929
SHA1: ca303052cd617c1af2e2c8d344c98a706fb63143
SHA256:4fb141dd8ef6b0585ffceea4bc49602fbc6312fa977e2c488794ea3e6aafecae
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
jna-5.19.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/net.java.dev.jna/jna@5.19.1   (Confidence:High)

jna-5.19.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-aarch64/jnidispatch.dll
MD5: 302945a811fd8e21bcdd5226c73b6f74
SHA1: 6b05e299ff2b3eb3b7b7aeac44263f715693607c
SHA256:b8f98be314234cf12b5b46c29652f70c0f6abb93ae19b63d3fe2692062aa699d
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile

Identifiers

  • None

jna-5.19.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-x86-64/jnidispatch.dll
MD5: 2d2475f1f026dd54e9f3e787ae4f81da
SHA1: 27ff882ac271db547aee520b38e3ba9aa91e136c
SHA256:5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile

Identifiers

  • None

jna-5.19.1.jar: jnidispatch.dll

File Path: /home/runner/.m2/repository/net/java/dev/jna/jna/5.19.1/jna-5.19.1.jar/com/sun/jna/win32-x86/jnidispatch.dll
MD5: 0caa1ef75a807f9dde05084fa2219a5c
SHA1: 2f5e1cd82cde192905c7510ce99037b67d980640
SHA256:752d597cee7e95cb517327146bf42f124c0d6c0bc48b3ecc3b1b3b0531a52f44
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile

Identifiers

  • None

jna-platform-5.19.1.jar

Description:

Java Native Access Platform

License:

LGPL-2.1-or-later: https://www.gnu.org/licenses/old-licenses/lgpl-2.1
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/net/java/dev/jna/jna-platform/5.19.1/jna-platform-5.19.1.jar
MD5: 1d97b6103a9b3b7ddb671908683f4566
SHA1: d1e54d9231da5ca3fa730d52960deaa555475468
SHA256:3b3864f5b449e9c3c24b16861524b622b086563f44e0cd8384c8efc5a6052f82
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
jna-platform-5.19.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/net.java.dev.jna/jna-platform@5.19.1   (Confidence:High)

jspecify-1.0.0.jar

Description:

An artifact of well-named and well-specified annotations to power static analysis checks

License:

The Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar
MD5: 9133aba420d0ca3b001dbb6ae9992cf6
SHA1: 7425a601c1c7ec76645a78d22b8c6a627edee507
SHA256:1fad6e6be7557781e4d33729d49ae1cdc8fdda6fe477bb0cc68ce351eafdfbab
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
jspecify-1.0.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/org.jspecify/jspecify@1.0.0   (Confidence:High)

jsr305-3.0.2.jar

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:provided
jsr305-3.0.2.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4

Identifiers

  • pkg:maven/com.google.code.findbugs/jsr305@3.0.2   (Confidence:High)

jul-to-slf4j-2.0.18.jar

Description:

JUL to SLF4J bridge

License:

https://opensource.org/license/mit
File Path: /home/runner/.m2/repository/org/slf4j/jul-to-slf4j/2.0.18/jul-to-slf4j-2.0.18.jar
MD5: f339bf7648049b2105e180cab6c45c9d
SHA1: 79739c98001d5c9d078d087d5a348ec9e474ec8f
SHA256:cbb7d1aaaa9e871eb1a06594abd911bf97027152976edf1edc315be75239204e
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
jul-to-slf4j-2.0.18.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Identifiers

  • pkg:maven/org.slf4j/jul-to-slf4j@2.0.18   (Confidence:High)

log4j-api-2.26.1.jar

Description:

The logging API of the Log4j project.
    Library and application code can log through this API.
    It contains a simple built-in implementation (`SimpleLogger`) for trivial use cases.
    Production applications are recommended to use Log4j API in combination with a fully-fledged implementation, such as Log4j Core.

License:

Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/logging/log4j/log4j-api/2.26.1/log4j-api-2.26.1.jar
MD5: 8ed35fc9ea449bc9e21a8139842d6233
SHA1: b9864ed8d0c01f65f3b0bf70f1447e5cc1b49c24
SHA256:f1810a4704ccce019d02bba029dc02a4f2ac0c997f647b465e7d409c1927f822
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
log4j-api-2.26.1.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Identifiers

logback-core-1.5.34.jar

Description:

logback-core module

License:

https://www.eclipse.org/legal/epl-v20.html, https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
File Path: /home/runner/.m2/repository/ch/qos/logback/logback-core/1.5.34/logback-core-1.5.34.jar
MD5: ef459237a22ab546dd001ff612dce80d
SHA1: 378692f76c337b3325c15bffb89e013dc1f897b4
SHA256:42eda264c0c650c2bec59e66151a88b708a8663dc1b49d788202d53e78b8caae
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
logback-core-1.5.34.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Identifiers

micrometer-commons-1.15.12.jar

Description:

Module containing common code

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/io/micrometer/micrometer-commons/1.15.12/micrometer-commons-1.15.12.jar
MD5: 8172f342d797138ec7a1a20e0332568c
SHA1: eb539638d48571fa6ce4ea3eb8417cab37a63438
SHA256:4b779cf7acb0534bb1f8e964f25200037ecb3944368f859a630fa637d6d5d7c0
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
micrometer-commons-1.15.12.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/io.micrometer/micrometer-commons@1.15.12   (Confidence:High)

micrometer-observation-1.15.12.jar

Description:

Module containing Observation related code

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/io/micrometer/micrometer-observation/1.15.12/micrometer-observation-1.15.12.jar
MD5: b6ea6ebf93debb874d7c10f3ae79a471
SHA1: 1d96fcaec8d2516236dfcb9914108e14bfd02238
SHA256:54483e68ed44af1bb0c36d1df2235d36f233e459d52f5a3be3e69813827a6300
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
micrometer-observation-1.15.12.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/io.micrometer/micrometer-observation@1.15.12   (Confidence:High)

slf4j-api-2.0.18.jar

Description:

The slf4j API

License:

https://opensource.org/license/mit
File Path: /home/runner/.m2/repository/org/slf4j/slf4j-api/2.0.18/slf4j-api-2.0.18.jar
MD5: fe2837bd49bfb76657419002fed20ca9
SHA1: 78a9e7a37cd6360e0b818e86341b24123d28d4df
SHA256:44508fd1576500688c790b190acdd16fec4f8c79a3e0b900afd70503cf055f55
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
slf4j-api-2.0.18.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.slf4j/slf4j-simple@2.0.19

Identifiers

  • pkg:maven/org.slf4j/slf4j-api@2.0.18   (Confidence:High)

snakeyaml-2.4.jar

Description:

YAML 1.1 parser and emitter for Java

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/yaml/snakeyaml/2.4/snakeyaml-2.4.jar
MD5: 29410ee3a987e3bff7b847933c591972
SHA1: e0666b825b796f85521f02360e77f4c92c5a7a07
SHA256:ef779af5d29a9dde8cc70ce0341f5c6f7735e23edff9685ceaa9d35359b7bb7f
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
snakeyaml-2.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Identifiers

spotbugs-annotations-4.10.4.jar

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html
File Path: /home/runner/.m2/repository/com/github/spotbugs/spotbugs-annotations/4.10.4/spotbugs-annotations-4.10.4.jar
MD5: 472925cb4e5451c8f7a1aeeefe286622
SHA1: 7eb4c58212378becfb6ea6d236ec24a2352a316e
SHA256:28fa4befaddce5d7b79b07c68e7c12fa27c5d9282c4229528717971606661ea3
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:provided
spotbugs-annotations-4.10.4.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT

Identifiers

  • pkg:maven/com.github.spotbugs/spotbugs-annotations@4.10.4   (Confidence:High)

spring-boot-3.5.16.jar

Description:

Spring Boot

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /home/runner/.m2/repository/org/springframework/boot/spring-boot/3.5.16/spring-boot-3.5.16.jar
MD5: 7a7ad5afd579e7a5b871dd29bf3ff406
SHA1: 8e75e8d0d3cfbca088774df8d30b45bbd21e5d99
SHA256:2d5b16632402b840b0425ed52610071890bf8cb24c6c49af343bbde574123265
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
spring-boot-3.5.16.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-boot-autoconfigure3@3.6.1-SNAPSHOT

Identifiers

spring-core-6.2.19.jar

Description:

Spring Core

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /home/runner/.m2/repository/org/springframework/spring-core/6.2.19/spring-core-6.2.19.jar
MD5: 4afe3968028c2b743dbff2d79013e144
SHA1: 691459d4644894dae8e5c2d9550a4cfb8302f62f
SHA256:52146689e71a911c92bac26677d73c692512a739893a57710cc233591756bff6
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
spring-core-6.2.19.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

CVE-2026-47884  

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47890  

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47891  

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47892  

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE
CWE-863 Incorrect Authorization

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59313  

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59283  

Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-913 Improper Control of Dynamically-Managed Code Resources

CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47885  

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
CWE-770 Allocation of Resources Without Limits or Throttling

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47886  

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-400 Uncontrolled Resource Consumption

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47888  

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE
CWE-401 Missing Release of Memory after Effective Lifetime

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47889  

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
CWE-1275 Sensitive Cookie with Improper SameSite Attribute

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47893  

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-209 Generation of Error Message Containing Sensitive Information

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59282  

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-400 Uncontrolled Resource Consumption

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47883  

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47887  

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59281  

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59280  

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv3:
  • Base Score: MEDIUM (4.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59314  

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
NVD-CWE-Other, CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

CVSSv3:
  • Base Score: LOW (3.7)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

spring-security-core-6.5.11.jar

Description:

Spring Security

License:

Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0
File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-core/6.5.11/spring-security-core-6.5.11.jar
MD5: 697081575fdb870e6c77e4f489acb192
SHA1: d57309ff65d122a2fa45a3a8f47b01e9183cb6e6
SHA256:26ac26527cc015c5c71f3832add705a2410129a8f8de847054f2bc3b1d2e4465
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
spring-security-core-6.5.11.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.waffle/waffle-spring-security6@3.6.1-SNAPSHOT

Identifiers

CVE-2026-59270  

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
CWE-863 Incorrect Authorization

CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47841  

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
CWE-863 Incorrect Authorization

CVSSv3:
  • Base Score: HIGH (7.4)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-47842  

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
CWE-326 Inadequate Encryption Strength

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59276  

Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Spring Security 5.8.0 - 5.8.27
Spring Security 5.7.0 - 5.7.25
CWE-208 Observable Timing Discrepancy

CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

spring-security-web-6.5.11.jar: spring-security-webauthn.js

File Path: /home/runner/.m2/repository/org/springframework/security/spring-security-web/6.5.11/spring-security-web-6.5.11.jar/org/springframework/security/spring-security-webauthn.js
MD5: d8d90d854a23d021c2e758b3eebce213
SHA1: 7814ccd3adc2388f52b2658bf5fc30b457949ab6
SHA256:044a2b8d7e995bff815565678631a2d3a5cc0aa96ef8ac35cfacb579307f77a9
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile

Identifiers

  • None

tomcat-embed-core-10.1.55.jar

Description:

Core Tomcat implementation

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/10.1.55/tomcat-embed-core-10.1.55.jar
MD5: b56211060ef226699d7c6746444c94e9
SHA1: 740c1000c60766b3a4d99903434fd1a1d67ec229
SHA256:82473f841824095e03f2c938c18707e44e388e34fb1735b2b338bb4f22fd54f0
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
tomcat-embed-core-10.1.55.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Identifiers

CVE-2026-65637  

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.



This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-65905  

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST 
authenticated request with a nonceCount on the upper boundary of the 
replay window then that request is replayable once only while the 
associated nonceCount remains within the replay window.



 

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CWE-294 Authentication Bypass by Capture-replay

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-53434  

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
CWE-390 Detection of Error Condition Without Action

CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-55276  

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
CWE-670 Always-Incorrect Control Flow Implementation

CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59083  

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
CWE-177 Improper Handling of URL Encoding (Hex Encoding)

CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-59084  

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue.
CWE-1059 Insufficient Technical Documentation

CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-65182  

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.



Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
CWE-863 Incorrect Authorization, CWE-284 Improper Access Control

CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-68525  

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.







This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.







The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.















Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.
CWE-863 Incorrect Authorization

CVSSv3:
  • Base Score: CRITICAL (9.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-65183  

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.



Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv3:
  • Base Score: HIGH (8.1)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-66422  

Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CWE-285 Improper Authorization

CVSSv3:
  • Base Score: HIGH (8.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-68569  

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.







The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.







Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CWE-287 Improper Authentication

CVSSv3:
  • Base Score: HIGH (8.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-65927  

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.







This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.
CWE-193 Off-by-one Error

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-68763  

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CWE-400 Uncontrolled Resource Consumption

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-53404  

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
CWE-670 Always-Incorrect Control Flow Implementation

CVSSv3:
  • Base Score: HIGH (7.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-73180  

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.



The following versions were EOL at the time the CVE was created but are 
known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
CWE-613 Insufficient Session Expiration

CVSSv3:
  • Base Score: MEDIUM (6.8)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-55955  

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.
CWE-287 Improper Authentication

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-55956  

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
CWE-285 Improper Authorization

CVSSv3:
  • Base Score: MEDIUM (6.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-50229  

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv3:
  • Base Score: MEDIUM (6.1)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2026-66299  

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.

This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.

Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.
CWE-400 Uncontrolled Resource Consumption

CVSSv3:
  • Base Score: MEDIUM (5.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

tomcat-embed-el-10.1.55.jar

Description:

Core Tomcat implementation

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt
File Path: /home/runner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-el/10.1.55/tomcat-embed-el-10.1.55.jar
MD5: 3aa05b1e98fe6122d642e890db5f599c
SHA1: 202f2de13bd61be720cf302f28d63eda558d29f3
SHA256:a527fe51c6f9428c5116f78fe28588e55357b4492309b51fb0453372da16fa5f
Referenced In Project/Scope: waffle-spring-boot-autoconfigure3:compile
tomcat-embed-el-10.1.55.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/org.springframework.boot/spring-boot-starter-web@3.5.16

Identifiers

  • pkg:maven/org.apache.tomcat.embed/tomcat-embed-el@10.1.55   (Confidence:High)


This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype Guide OSS Index API.