Spring Projects: 25 Vulnerabilities Disclosed, Including Critical Flaws in Framework and GraphQL
A batch of 25 vulnerabilities, including critical flaws in Spring Framework and Spring for GraphQL, were disclosed on August 27, 2026, affecting numerous Spring Projects.
Key findings
- 25 Spring Projects CVEs disclosed together on August 27, 2026, ranging from Low to Critical severity.
- Critical flaws include stream corruption in SSE (CVE-2026-59313) and SpEL safety guard bypass (CVE-2026-59283).
- Vulnerabilities span insecure deserialization, XSS, path traversal, and DoS across multiple Spring projects.
- Affected projects include Spring Framework, Integration, Security, Authorization Server, and for GraphQL.
- Patches are available for various versions; users should consult official advisories for upgrade paths.
On August 27, 2026, a significant batch of 25 vulnerabilities was disclosed across various Spring Projects, impacting core components like Spring Framework, Spring Integration, Spring Security, and Spring for GraphQL. These vulnerabilities, disclosed within a three-hour window, range in severity from Low to Critical, with CVSS scores reaching up to 9.8. The disclosures highlight potential risks including insecure deserialization, cross-site scripting (XSS), denial of service (DoS), path traversal, and information disclosure.
Several vulnerabilities stem from improper handling of user-controlled input and inadequate sanitization. CVE-2026-59322, for instance, involves an overly permissive header parsing posture in EmbeddedHeadersJsonMessageMapper that can lead to deserialization of untrusted JSON headers. Similarly, CVE-2026-59316, a High severity vulnerability, arises from Spring Authorization Server's default consent page rendering user-controlled values without HTML entity encoding, potentially allowing an attacker to craft malicious authorization requests.
A critical vulnerability, CVE-2026-59313 (CVSSv3 9.8), affects Spring MVC and WebFlux applications using the functional web framework with Server-Sent Events (SSE), leading to stream corruption. Another critical flaw, CVE-2026-59283 (CVSSv3 9.1), impacts applications evaluating Spring Expression Language (SpEL) expressions with SimpleEvaluationContext when the SpEL expression compiler is active, potentially bypassing safety guards.
Other notable issues include CVE-2026-59320 and CVE-2026-59317, both related to message handling in Spring Integration and Apache Kafka respectively, where improper error handling or header parsing can lead to message loss or data corruption. CVE-2026-59294 in Spring AI presents a path traversal vulnerability in ResourceCacheService, allowing an attacker to write files to arbitrary locations.
The batch also includes several vulnerabilities affecting Spring for GraphQL, such as CVE-2026-59288 and CVE-2026-59286, which involve potential information leakage and arbitrary code execution due to the GraphiQL page loading scripts from a public CDN without Subresource Integrity checks. CVE-2026-59285, also noted in related news, points to an unsafe deserialization vulnerability when processing paginated GraphQL queries.
Spring Security is not exempt, with CVE-2026-59276 highlighting the use of standard string equality for security-sensitive comparisons, potentially enabling timing attacks. CVE-2026-59272, a Low severity issue, relates to the classification of IP addresses by InetAddressMatchers.
The disclosures indicate that fixes are available across multiple versions of affected projects, including Spring Framework (versions 7.0.x, 6.2.x, 6.1.x, 6.0.x, 5.3.x), Spring Integration (versions 7.1.x, 7.0.x, 6.5.x, 6.4.x), Spring Security (version 7.1.x), Spring for GraphQL (versions 2.0.x, 1.4.x, 1.3.x), Spring AI (versions 2.0.x, 1.1.x, 1.0.x), and Spring AMQP (versions 4.1.x, 4.0.x, 3.2.x). Users are advised to consult the official Spring advisories for specific version information and upgrade paths.
This extensive batch of vulnerabilities underscores the importance of timely patching and security reviews for applications built on the Spring ecosystem. Developers should prioritize addressing these issues to mitigate risks associated with insecure deserialization, input validation, and component-specific flaws.
The related news coverage from Cyber Security News and SecurityWeek indicates that this disclosure is part of a larger set of 91 vulnerabilities affecting the Spring ecosystem, impacting a significant number of software components. While no specific threat actor or active exploitation was detailed for this particular batch, the sheer volume and severity of the disclosed flaws warrant immediate attention from all Spring users.
The vulnerabilities disclosed on August 27, 2026, present a wide array of risks across the Spring Projects ecosystem. The critical and high-severity flaws, in particular, demand urgent attention from developers and system administrators. Staying updated with Spring security advisories and applying patches promptly is crucial for maintaining the security posture of applications built on these widely used frameworks. The interconnected nature of these projects means that a vulnerability in one component can have cascading effects, making a comprehensive approach to security essential.