Which function in spring-projects/spring-framework has been patched by the most CVEs?

createXmlInputFactory in spring-web/src/main/java/org/springframework/http/converter/xml/Jaxb2CollectionHttpMessageConverter.java has been changed by 4 CVE fixes, from 2014 to 2016.

How large is a typical CVE fix in spring-projects/spring-framework?

The median fix changes 67 lines. 17% of fixes change 20 lines or fewer, and 6% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

java

#73 of 500 repositories

spring-projects/spring-framework

Name: spring-projects/spring-framework: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 27, 2026

54

CVE fixes located

Published CVEs

400

Functions patched

Distinct function sites

197

Files patched

Distinct source files

2010–2026

Years covered

By CVE publication date

Overview

54 published CVEs have a fix traced to functions in spring-projects/spring-framework, the earliest published in 2010. Those fixes changed 400 distinct functions across 197 files, in 1,354 patch hunks.

Among the 500 repositories tracked here, spring-projects/spring-framework ranks #73 by the number of CVEs with a located fix.

Most patched functions

Functions in spring-projects/spring-framework changed by the most CVE fixes.

Most patched files

Files in spring-projects/spring-framework changed by the most CVE fixes.

1spring-web/src/main/java/org/springframework/http/converter/xml/Jaxb2CollectionHttpMessageConverter.java5 CVEs · 2 functions
2spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandler.java4 CVEs · 10 functions
3spring-oxm/src/main/java/org/springframework/oxm/jaxb/Jaxb2Marshaller.java4 CVEs · 8 functions
4spring-oxm/src/main/java/org/springframework/oxm/support/AbstractMarshaller.java3 CVEs · 11 functions
5spring-webflux/src/main/java/org/springframework/web/reactive/resource/ResourceWebHandler.java3 CVEs · 9 functions
6spring-expression/src/main/java/org/springframework/expression/spel/standard/InternalSpelExpressionParser.java3 CVEs · 7 functions
7spring-web/src/main/java/org/springframework/http/converter/xml/SourceHttpMessageConverter.java3 CVEs · 7 functions
8spring-context/src/main/java/org/springframework/validation/DataBinder.java3 CVEs · 6 functions
9spring-web/src/main/java/org/springframework/http/converter/xml/Jaxb2RootElementHttpMessageConverter.java3 CVEs · 6 functions
10spring-expression/src/main/java/org/springframework/expression/spel/ast/ConstructorReference.java3 CVEs · 4 functions

Fix size

How much code a CVE fix in spring-projects/spring-framework changes, with backports counted once.

67

Median lines changed

Added plus removed, per CVE

17%

Fixes of 20 lines or fewer

Share of CVE fixes

6%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in spring-projects/spring-framework, and the functions each fix changed.

Spring Framework Improper Path Limitation in XsltView
CVE-2026-47884getStylesheetSource
Critical · CVSS 9.8
EPSS 0.6%2026-08-27
Spring Framework Unsafe Deserialization via Jackson JMS Converters
CVE-2026-41855isTrustedPackage setTrustedPackages getJavaTypeForMessage
Critical · CVSS 9.8
EPSS 0.5%2026-06-09
Spring Framework Denial of Service via Unbounded Cache in SpEL
CVE-2026-41851SpelParserConfiguration InlineMap InlineList
High · CVSS 7.5
EPSS 0.5%2026-06-09
Spring Framework Denial of Service via AntPathMatcher
CVE-2026-41848MaxAttemptsCharSequence matchStrings
High · CVSS 7.5
EPSS 0.4%2026-06-09
Spring Framework Cross-site Scripting via JSP Form Tags
CVE-2026-41846resolveCssClass writeOptionalAttributes
Medium · CVSS 6.1
EPSS 0.2%2026-06-09
Spring Framework Cross-site Scripting via JavaScriptUtils
CVE-2026-41845JavaScriptUtils
High · CVSS 7.1
EPSS 0.3%2026-06-09
Spring Framework Open Redirect in Spring MVC and WebFlux
CVE-2026-41844handleResult setStripExtension getDefaultViewName
Medium · CVSS 6.1
EPSS 0.2%2026-06-09
Spring Framework Escalation via Session Fixation in WebFlux
CVE-2026-41839changeSessionId notification save
Medium · CVSS 4.2
EPSS 0.2%2026-06-09
Spring Framework Predictable Session ID in WebSocket Module
CVE-2026-41838AbstractWebSocketSession
High · CVSS 7.5
EPSS 0.3%2026-06-09
CVE-2025-41249: Spring Framework Annotation Detection Vulnerability
CVE-2025-41249hasSameGenericTypeParameters isOverrideFor
High · CVSS 7.5
EPSS 0.5%2025-09-16
RFD Attack via “Content-Disposition” Header Sourced from Request
CVE-2025-41234ContentDisposition
Medium · CVSS 6.5
EPSS 0.6%2025-06-12
Spring Framework DataBinder Case Sensitive Match Exception
CVE-2025-22233must isAllowed checkAllowedFields
Low · CVSS 3.1
EPSS 0.4%2025-05-16

Get an alert for each new spring-projects/spring-framework CVE, with the patched functions and AI-written analysis.

Monitor spring-framework CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

gogs/gogs54 CVEs ansible/ansible55 CVEs krb5/krb555 CVEs froxlor/froxlor53 CVEs grokability/snipe-it53 CVEs libexpat/libexpat56 CVEs wekan/wekan56 CVEs debian/qemu52 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in spring-projects/spring-framework.

How many CVEs have a located fix in spring-projects/spring-framework?: 54 published CVEs have a fix traced to functions in spring-projects/spring-framework, touching 400 functions across 197 files.
Which function in spring-projects/spring-framework has been patched by the most CVEs?: createXmlInputFactory in spring-web/src/main/java/org/springframework/http/converter/xml/Jaxb2CollectionHttpMessageConverter.java has been changed by 4 CVE fixes, from 2014 to 2016.
How large is a typical CVE fix in spring-projects/spring-framework?: The median fix changes 67 lines. 17% of fixes change 20 lines or fewer, and 6% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track spring-projects/spring-framework CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing