How many CVEs does vmware spring framework have?

vmware spring framework has 74 published CVE records since 2011.

How many vmware spring framework CVEs are in CISA KEV?

Yes — 1 of vmware spring framework's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for vmware spring framework vulnerabilities?

Yes — 14 of vmware spring framework's CVEs have a known public exploit.

Which versions of vmware spring framework are affected?

241 distinct vmware spring framework versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in vmware spring framework CVEs?

vmware spring framework's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')).

How many critical vmware spring framework vulnerabilities are there?

vmware spring framework has 8 critical and 26 high-severity CVEs.

What is the average severity of vmware spring framework CVEs?

The average CVSS base score across vmware spring framework's scored CVEs is 6.8.

vmware spring framework Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every vmware spring framework version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

5.3.x1 CVE
6.0.x1 CVE
6.1.x1 CVE
6.2.x1 CVE

Version ranges

5.3.0 <= v < 5.3.4916 CVEs
6.1.0 <= v < 6.1.2815 CVEs
6.2.0 <= v < 6.2.18.115 CVEs
7.0.0 <= v < 7.0.7.115 CVEs
3.2.1 <= v <= 3.2.18 CVEs
3.2.2 <= v <= 3.2.28 CVEs
3.2.3 <= v <= 3.2.36 CVEs
3.2.4 <= v <= 3.2.46 CVEs
4.0.0 <= v <= 4.0.06 CVEs
3.2.0 <= v <= 3.2.05 CVEs
3.2.5 <= v <= 3.2.55 CVEs
3.2.6 <= v <= 3.2.65 CVEs
3.2.7 <= v <= 3.2.75 CVEs
3.2.8 <= v <= 3.2.85 CVEs
3.0.6 <= v <= 3.0.64 CVEs
3.0.7 <= v <= 3.0.74 CVEs
3.1.0 <= v <= 3.1.04 CVEs
3.1.1 <= v <= 3.1.14 CVEs
3.1.2 <= v <= 3.1.24 CVEs
3.1.3 <= v <= 3.1.34 CVEs
3.1.4 <= v <= 3.1.44 CVEs
3.2.10 <= v <= 3.2.104 CVEs
3.2.11 <= v <= 3.2.114 CVEs
3.2.12 <= v <= 3.2.124 CVEs
3.2.13 <= v <= 3.2.134 CVEs
3.2.9 <= v <= 3.2.94 CVEs
4.1.1 <= v <= 4.1.14 CVEs
4.1.2 <= v <= 4.1.24 CVEs
4.1.3 <= v <= 4.1.34 CVEs
4.1.4 <= v <= 4.1.44 CVEs
< 5.3.483 CVEs
3.2.14 <= v <= 3.2.143 CVEs
4.0.1 <= v <= 4.0.13 CVEs
4.0.2 <= v <= 4.0.23 CVEs
4.0.3 <= v <= 4.0.33 CVEs
4.0.4 <= v <= 4.0.43 CVEs
4.1.5 <= v <= 4.1.53 CVEs
4.1.6 <= v <= 4.1.63 CVEs
4.2.1 <= v <= 4.2.13 CVEs
5.0.0 <= v < 5.0.53 CVEs
5.3.0 <= v < 5.3.483 CVEs
6.1.0 <= v < 6.1.273 CVEs
6.2.0 <= v < 6.2.183 CVEs
7.0.0 <= v < 7.0.73 CVEs
< 4.3.182 CVEs
< 5.2.202 CVEs
< 5.3.472 CVEs
<= 3.2.32 CVEs
3.2.15 <= v <= 3.2.152 CVEs
3.2.16 <= v <= 3.2.162 CVEs
3.2.17 <= v <= 3.2.172 CVEs
4.0.5 <= v <= 4.0.52 CVEs
4.0.6 <= v <= 4.0.62 CVEs
4.0.7 <= v <= 4.0.72 CVEs
4.0.8 <= v <= 4.0.82 CVEs
4.0.9 <= v <= 4.0.92 CVEs
4.1.7 <= v <= 4.1.72 CVEs
4.2.2 <= v <= 4.2.22 CVEs
4.2.3 <= v <= 4.2.32 CVEs
4.2.4 <= v <= 4.2.42 CVEs
4.2.5 <= v <= 4.2.52 CVEs
4.2.6 <= v <= 4.2.62 CVEs
4.2.7 <= v <= 4.2.72 CVEs
4.2.8 <= v <= 4.2.82 CVEs
4.3.0 <= v < 4.3.152 CVEs
5.0.0 <= v < 5.0.72 CVEs
5.2.0 <= v < 5.2.32 CVEs
5.3.0 <= v <= 5.3.192 CVEs
6.1.0 <= v < 6.1.262 CVEs
6.2.0 <= v < 6.2.172 CVEs
7.0.0 <= v < 7.0.62 CVEs
< 4.3.161 CVE
< 4.3.171 CVE
< 4.3.291 CVE
< 5.2.01 CVE
< 5.3.331 CVE
< 5.3.491 CVE
< 6.0.01 CVE
<= 3.2.71 CVE
<= 5.2.211 CVE
<= 5.2.221 CVE
>= 5.3.01 CVE
>= 6.0.291 CVE
>= 6.1.211 CVE
>= 6.2.81 CVE
3.0.0 <= v <= 3.0.51 CVE
3.0.1 <= v <= 3.0.11 CVE
3.0.2 <= v <= 3.0.21 CVE
3.0.3 <= v <= 3.0.31 CVE
3.0.4 <= v <= 3.0.41 CVE
3.0.4 <= v <= 3.0.71 CVE
3.0.5 <= v <= 3.0.51 CVE
3.2.18 <= v <= 3.2.181 CVE
4.1.0 <= v <= 4.1.01 CVE
4.1.8 <= v <= 4.1.81 CVE
4.1.9 <= v <= 4.1.91 CVE
4.2.0 <= v < 4.3.201 CVE
4.2.0 <= v <= 4.2.01 CVE
4.2.9 <= v <= 4.2.91 CVE
4.3.0 <= v < 4.3.141 CVE
4.3.0 <= v < 4.3.161 CVE
4.3.1 <= v <= 4.3.11 CVE
4.3.2 <= v <= 4.3.21 CVE
4.3.3 <= v <= 4.3.31 CVE
4.3.4 <= v <= 4.3.41 CVE
5.0 <= v < 5.0.51 CVE
5.0.0 <= v < 5.0.101 CVE
5.0.0 <= v < 5.0.161 CVE
5.0.0 <= v < 5.0.191 CVE
5.0.0 <= v < 5.0.31 CVE
5.0.0 <= v < 5.0.61 CVE
5.0.5 <= v <= 5.0.51 CVE
5.1.0 <= v < 5.1.131 CVE
5.1.0 <= v < 5.1.181 CVE
5.1.0 <= v < 5.1.21 CVE
5.1.0 <= v <= 5.1.01 CVE
5.2.0 <= v < 5.2.151 CVE
5.2.0 <= v < 5.2.241 CVE
5.2.0 <= v < 5.2.91 CVE
5.2.0 <= v <= 5.2.171 CVE
5.2.0 <= v <= 5.2.181 CVE
5.2.0 <= v <= 5.2.201 CVE
5.2.0 <= v <= 5.2.211 CVE
5.3.0 <= v < 5.3.171 CVE
5.3.0 <= v < 5.3.181 CVE
5.3.0 <= v < 5.3.261 CVE
5.3.0 <= v < 5.3.271 CVE
5.3.0 <= v < 5.3.331 CVE
5.3.0 <= v < 5.3.341 CVE
5.3.0 <= v < 5.3.391 CVE
5.3.0 <= v < 5.3.411 CVE
5.3.0 <= v < 5.3.71 CVE
5.3.0 <= v <= 5.3.101 CVE
5.3.0 <= v <= 5.3.131 CVE
5.3.0 <= v <= 5.3.181 CVE
5.3.0 <= v <= 5.3.251 CVE
5.3.0 <= v <= 5.3.371 CVE
5.3.x <= v < 5.3.441 CVE
5.3.x <= v < 5.3.451 CVE
6.0.0 <= v < 6.0.141 CVE
6.0.0 <= v < 6.0.171 CVE
6.0.0 <= v < 6.0.181 CVE
6.0.0 <= v < 6.0.191 CVE
6.0.0 <= v < 6.0.251 CVE
6.0.0 <= v < 6.0.71 CVE
6.0.0 <= v < 6.0.81 CVE
6.0.0 <= v <= 6.0.221 CVE
6.0.0 <= v <= 6.0.61 CVE
6.0.15 <= v <= 6.0.151 CVE
6.0.5 <= v <= 6.0.281 CVE
6.1.0 <= v < 6.1.141 CVE
6.1.0 <= v < 6.1.41 CVE
6.1.0 <= v < 6.1.51 CVE
6.1.0 <= v < 6.1.61 CVE
6.1.0 <= v <= 6.1.111 CVE
6.1.0 <= v <= 6.1.201 CVE
6.1.2 <= v <= 6.1.21 CVE
6.1.x <= v < 6.1.221 CVE
6.1.x <= v < 6.1.231 CVE
6.2.0 <= v < 6.2.191 CVE
6.2.0 <= v <= 6.2.71 CVE
6.2.x <= v < 6.2.101 CVE
6.2.x <= v < 6.2.111 CVE
7.0.0 <= v < 7.0.81 CVE

Fixed in

5.3.4917 CVEs
6.1.2815 CVEs
6.2.18.115 CVEs
7.0.7.115 CVEs
5.0.54 CVEs
5.3.483 CVEs
6.1.273 CVEs
6.2.183 CVEs
7.0.73 CVEs
4.3.152 CVEs
4.3.162 CVEs
4.3.182 CVEs
5.0.72 CVEs
5.2.202 CVEs

Find a version

74 CVEs

Sort

Spring Framework Unsafe Deserialization via Jackson JMS Converters
CVE-2026-41855
Patch
CWE-502
Critical · CVSS 9.8
EPSS 0.3% (19th pct)2026-06-09
Spring Framework Server-Side Request Forgery via UriComponentsBuilder
CVE-2026-41854
Patch
CWE-918
Medium · CVSS 6.5
EPSS 0.1% (2th pct)2026-06-09
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
CVE-2026-41853
Patch
CWE-444
Medium · CVSS 5.3
EPSS 0.2% (8th pct)2026-06-09
Spring Framework Arbitrary Method Invocation in SpEL Expressions
CVE-2026-41852
Patch
CWE-863
Medium · CVSS 5.3
EPSS 0.2% (8th pct)2026-06-09
Spring Framework Denial of Service via Unbounded Cache in SpEL
CVE-2026-41851
Patch
CWE-770
High · CVSS 7.5
EPSS 0.4% (29th pct)2026-06-09
Spring Framework Algorithmic Denial of Service via SpEL Expressions
CVE-2026-41850
Patch
CWE-407
High · CVSS 7.5
EPSS 0.4% (29th pct)2026-06-09
Spring Framework Denial of Service via Integer Overflow in SpEL Expressions
CVE-2026-41849
Patch
CWE-190
High · CVSS 7.5
EPSS 0.3% (18th pct)2026-06-09
Spring Framework Denial of Service via AntPathMatcher
CVE-2026-41848
Patch
CWE-1333
High · CVSS 7.5
EPSS 0.3% (24th pct)2026-06-09
Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL
CVE-2026-41847
Patch
CWE-284
Medium · CVSS 5.3
EPSS 0.2% (6th pct)2026-06-09
Spring Framework Cross-site Scripting via JSP Form Tags
CVE-2026-41846
Patch
CWE-79
Medium · CVSS 6.1
EPSS 0.1% (4th pct)2026-06-09
Spring Framework Cross-site Scripting via JavaScriptUtils
CVE-2026-41845
Patch
CWE-79
High · CVSS 7.1
EPSS 0.2% (6th pct)2026-06-09
Spring Framework Open Redirect in Spring MVC and WebFlux
CVE-2026-41844
Patch
CWE-601
Medium · CVSS 6.1
EPSS 0.1% (3th pct)2026-06-09
Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux
CVE-2026-41843
Patch
CWE-22
Medium · CVSS 5.9
EPSS 0.3% (27th pct)2026-06-09
Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux
CVE-2026-41842
Patch
CWE-400
High · CVSS 7.5
EPSS 0.4% (33th pct)2026-06-09
Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux
CVE-2026-41841
Patch
CWE-524
Medium · CVSS 5.9
EPSS 0.3% (24th pct)2026-06-09
Medium vulnerability · 2026-06-09
CVE-2026-41840
Patch
CWE-401
Medium · CVSS 5.9
EPSS 0.2% (16th pct)2026-06-09
Spring Framework Escalation via Session Fixation in WebFlux
CVE-2026-41839
Patch
CWE-384
Medium · CVSS 4.2
EPSS 0.2% (10th pct)2026-06-09
Spring Framework Predictable Session ID in WebSocket Module
CVE-2026-41838
Patch
CWE-330
High · CVSS 7.5
EPSS 0.2% (7th pct)2026-06-09
CVE-2026-22745 : Denial of service in static resource handling on Windows platforms
CVE-2026-22745
Patch
CWE-400
Medium · CVSS 5.3
EPSS 0.3% (27th pct)2026-04-29
Static resource cache poisoning in Spring MVC and WebFlux
CVE-2026-22741
Patch
CWE-524
Low · CVSS 3.1
EPSS 0.2% (15th pct)2026-04-29
Spring Framework DoS with Multipart Temp Files in WebFlux
CVE-2026-22740
Patch
CWE-400
Medium · CVSS 6.5
EPSS 0.3% (27th pct)2026-04-29
Spring Framework Improper Path Limitation with Script View Templates
CVE-2026-22737
Patch
CWE-22
Medium · CVSS 5.9
EPSS 0.4% (31th pct)2026-03-19
Server Sent Event stream corruption
CVE-2026-22735
Patch
CWE-667
Low · CVSS 2.6
EPSS 0.1% (2th pct)2026-03-19
Spring Framework STOMP CSRF Vulnerability
CVE-2025-41254
Patch
CWE-352
Medium · CVSS 4.3
EPSS 0.3% (22th pct)2025-10-16
CVE-2025-41249: Spring Framework Annotation Detection Vulnerability
CVE-2025-41249
Patch
CWE-285
High · CVSS 7.5
EPSS 0.5% (37th pct)2025-09-16
CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers
CVE-2025-41242
Patch
CWE-22
Medium · CVSS 5.9
EPSS 2.1% (79th pct)2025-08-18
RFD Attack via “Content-Disposition” Header Sourced from Request
CVE-2025-41234
Patch
CWE-113
Medium · CVSS 6.5
EPSS 0.5% (42th pct)2025-06-12
Medium vulnerability · 2024-10-18
CVE-2024-38820
Public exploit
Patch
CWE-178
Medium · CVSS 5.3
EPSS 0.6% (46th pct)2024-10-18
Medium vulnerability · 2024-09-27
CVE-2024-38809
Patch
CWE-400
Medium · CVSS 5.3
EPSS 0.9% (55th pct)2024-09-27
CVE-2024-38808: Spring Expression DoS Vulnerability
CVE-2024-38808
Patch
CWE-770
Medium · CVSS 5.1
EPSS 0.5% (42th pct)2024-08-20

Showing 30 of 74

vmware spring framework Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other vmware products

Frequently asked questions

References

Track vmware spring framework vulnerabilities