Org.springframework:spring-web
12 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Org.springframework:spring-web, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Org.springframework:spring-web CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 1 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 1 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 12 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High4
- Medium6
- Low1
Latest CVEs
The 12 most recently published vulnerabilities affecting Org.springframework:spring-web.
- CVE-2025-41234RFD Attack via “Content-Disposition” Header Sourced from Request6.5
- CVE-2024-38820CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception3.1
- CVE-2024-38809Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to the corresponding fixed version. Users ...5.3
- CVE-2024-22262CVE-2024-22262: Spring Framework URL Parsing with Host Validation8.1
- CVE-2024-22259CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)8.1
- CVE-2024-22243CVE-2024-22243: Spring Framework URL Parsing with Host Validation8.1
- CVE-2021-22118In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory...7.8
- CVE-2013-6430The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attacker...5.4
- CVE-2016-1000027Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented wi...9.8
- CVE-2018-11039Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (includi...5.9
- CVE-2015-3192Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of ser...5.5
- CVE-2013-6429The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbit...6.8
Product grouping is registry-driven, with AI assist and human review. How it works