CVE-20XX-?

VMware Spring Framework CVEs.

Published CVEs affecting VMware Spring Framework, ranked by exploit odds.

5 CVEs · updated 2026-11-06 08:42 UTC

Reset all
  1. CVE-2026-47890

    Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

    Other Server VMware Spring Framework

    9.8 CRITICAL 0.6% exploit odds Fix listed
  2. CVE-2026-59313

    Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49

    Other Server VMware Spring Framework

    9.8 CRITICAL 0.6% exploit odds Fix listed
  3. CVE-2026-22740

    A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsupported versions are also affected.

    Denial of service Server VMware Spring Framework

    6.5 MEDIUM 0.3% exploit odds Fix listed
  4. CVE-2026-41854

    Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

    Disclosure Server VMware Spring Framework

    4.2 MEDIUM 0.1% exploit odds Fix listed
  5. CVE-2026-22735

    Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

    Other Server VMware Spring Framework

    2.6 LOW 0.1% exploit odds Fix listed

All CVEs affecting VMware Spring Framework that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.