Broadcom Discloses 91 Spring Vulnerabilities, Affecting Over 209,000 Software Components
Broadcom has disclosed 91 new vulnerabilities impacting the Spring Framework and its related projects, affecting an estimated 209,569 software components across the open-source ecosystem.
Broadcom has issued a significant wave of security advisories, detailing 91 Common Vulnerabilities and Exposures (CVEs) that affect the widely-used Spring Framework and a host of its associated projects. This disclosure, tracked by Sonatype, impacts an estimated 209,569 software components, underscoring the pervasive reach and downstream consequences of vulnerabilities within the open-source software supply chain. The affected projects span critical components such as Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch.
The sheer volume of disclosed vulnerabilities presents a substantial challenge for organizations. Broadcom has provided fixes across several supported version lines, meaning that many enterprises may need to update multiple instances of the same product. The vulnerabilities encompass a range of security risks, including insecure deserialization, potential for remote code execution (RCE), server-side request forgery (SSRF), information disclosure, path traversal, denial-of-service (DoS) conditions, and authorization weaknesses. The complexity is further amplified as many affected components are likely to be present as transitive dependencies, embedded libraries, or dependencies of upstream frameworks, making comprehensive discovery and remediation a daunting task.
Among the high-impact vulnerabilities highlighted is CVE-2026-59285, an unsafe deserialization flaw affecting Spring for GraphQL. Sonatype has assigned this vulnerability a critical severity rating of 9.2. Exploitation of this flaw is possible when an application utilizes Jackson 2.x for JSON deserialization, exposes paginated GraphQL fields, and allows potentially dangerous classes to be deserialized. Under these specific conditions, an attacker could achieve remote code execution.
Another notable vulnerability, CVE-2026-59318, targets the tool-calling functionality within Spring AI. This flaw could enable prompt-injection attacks, allowing an attacker to trigger tools that were not intended for a particular request. If not properly managed at the system layer, this could pave the way for privilege escalation within AI-enabled applications.
The disclosure arrives at a time when the discovery of vulnerabilities is accelerating, partly due to the increasing use of Artificial Intelligence in security research. Sonatype reported a dramatic increase in newly affected component versions, rising at 46 times the rate observed before the widespread adoption of AI in vulnerability analysis. Similarly, the number of critical and high-severity vulnerabilities per enterprise application has seen a significant increase.
This surge in vulnerability reporting for Spring is not entirely new; Broadcom had previously noted a more than 1,700% rise in monthly Spring security advisories between March and April 2026. This trend reflects both advancements in security research methodologies and the capability of AI systems to rapidly identify potential weaknesses across vast codebases.
To mitigate the risks associated with this extensive disclosure, Sonatype recommends that defenders prioritize identifying vulnerable Spring versions in their production environments. Organizations should meticulously check both direct and transitive dependencies and assess their exposure based on reachable attack paths, rather than attempting to patch all 91 CVEs immediately. Particular attention should be paid to internet-facing services, GraphQL deployments, Spring AI implementations, and applications that process untrusted data.
In response, organizations are advised to review the detailed Spring advisories, update to the specified fixed versions, conduct thorough scans of their software bills of materials (SBOMs), and rigorously test all upgrades. As AI continues to accelerate the pace of vulnerability discovery, the need for equally rapid and intelligent methods for dependency intelligence, prioritization, and secure remediation becomes paramount for software supply chain security teams.