Skip to content

Update spring.version to v7.0.8 [SECURITY] - #33

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/spring.version
Open

Update spring.version to v7.0.8 [SECURITY]#33
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/spring.version

Conversation

@renovate

@renovate renovate Bot commented Jul 31, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
org.springframework:spring-webmvc 7.0.7 → 7.0.8 age confidence
org.springframework:spring-web 7.0.7 → 7.0.8 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Have a look at your dependency dashboard

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

CVE-2026-41841 / GHSA-mq64-j8f9-9gcj

More information

Details

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

CVE-2026-41842 / GHSA-x23c-287f-qqv5

More information

Details

Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux

CVE-2026-41843 / GHSA-72pg-x5f8-j25j

More information

Details

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Cross-site Scripting via JavaScriptUtils

CVE-2026-41845 / GHSA-3chg-m5w7-qfv5

More information

Details

Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Open Redirect in Spring MVC and WebFlux

CVE-2026-41844 / GHSA-h3qp-gqrc-q736

More information

Details

A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 4.2 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux

CVE-2026-41853 / GHSA-cjpg-rgq5-fr37

More information

Details

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Cross-site Scripting via JSP Form Tags

CVE-2026-41846 / GHSA-957g-f97v-vppc

More information

Details

Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript code injection, potentially resulting in a cross-site scripting (XSS) vulnerability.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring MVC controller vulnerable to a DoS attack

CVE-2024-38828 / GHSA-w3c8-7r8f-9jp8

More information

Details

Spring MVC controller methods with an @​RequestBody byte[] method parameter are vulnerable to a DoS attack.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Server-Side Request Forgery via UriComponentsBuilder

CVE-2026-41854 / GHSA-7m2p-62gw-p8qq

More information

Details

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

Severity

  • CVSS Score: 4.2 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Pivotal Spring Framework contains unsafe Java deserialization methods

CVE-2016-1000027 / GHSA-4wrc-f8pq-fpqp

More information

Details

Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.

Maintainers recommend investigating alternative components or a potential mitigating control. Version 4.2.6 and 3.2.17 contain enhanced documentation advising users to take precautions against unsafe Java deserialization, version 5.3.0 deprecate the impacted classes and version 6.0.0 removed it entirely.

Severity

  • CVSS Score: 9.8 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Web vulnerable to Open Redirect or Server Side Request Forgery

CVE-2024-22243 / GHSA-ccgv-vj62-xf9h

More information

Details

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.

Severity

  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework URL Parsing with Host Validation Vulnerability

CVE-2024-22259 / GHSA-hgjh-9rj2-g67j

More information

Details

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243, but with different input.

Severity

  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework URL Parsing with Host Validation

CVE-2024-22262 / GHSA-2wrp-6fg6-hmc5

More information

Details

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259  and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

Severity

  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework DoS via conditional HTTP request

CVE-2024-38809 / GHSA-2rmj-mq67-h97g

More information

Details

Description

Applications that parse ETags from If-Match or If-None-Match request headers are vulnerable to DoS attack.

Affected Spring Products and Versions

org.springframework:spring-web in versions

6.1.0 through 6.1.11
6.0.0 through 6.0.22
5.3.0 through 5.3.37

Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
6.1.x -> 6.1.12
6.0.x -> 6.0.23
5.3.x -> 5.3.38
No other mitigation steps are necessary.

Users of older, unsupported versions could enforce a size limit on If-Match and If-None-Match headers, e.g. through a Filter.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

spring-projects/spring-framework (org.springframework:spring-webmvc)

v7.0.8

Compare Source

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

  • CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
  • CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
  • CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
  • CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
  • CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
  • CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
  • CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
  • CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
  • CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
  • CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
  • CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
  • CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
  • CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
  • CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
  • CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
  • CVE-2026-41855 "Spring Framework Unsafe Deserialization via Jackson JMS Converters"

⭐ New Features

  • Include zone ID in CronTrigger's equals/hashCode implementations #​36871
  • Expose ClassLoader from DefaultDeserializer #​36833
  • Use immutable map for SEPARATORS static field in DefaultPathContainer #​36821
  • Track operations during SpEL expression evaluation #​36801
  • Ensure getters have non-void return types in SpEL #​36800
  • Avoid too many character access attempts in AntPathMatcher #​36799
  • Refine default view name resolution #​36793
  • Refine Jackson JMS converters #​36791
  • Improve ABNF rule checks in RfcUriParser #​36787
  • Restrict SpringVersion.getVersion() to "major.minor.patch" format #​36785
  • Runtime compatibility with JPA 4.0 M4 and corresponding Hibernate 8.0 snapshots #​36784
  • Allow specifying the charset to use in ExchangeFilterFunctions#basicAuthentication #​36777
  • Use CollectionUtils to initialize HashMap in DefaultUriBuilderFactory #​36763
  • Improve error messages in SpEL #​36756
  • Improve pattern caching in SpEL #​36755
  • Avoid ResolvableType#forType contention for implicit cache cleanup #​36745
  • Switch to JdkIdGenerator for WebSocket Sessions #​36740
  • Detect custom deserialized NullValue instances in AbstractValueAdaptingCache #​36727
  • LiteWebJarsResourceResolver does not resolve directories #​36726
  • Warn against unsafe static resource locations in MVC and WebFlux #​36692
  • Consistent compatibility with Woodstox as an alternative to Xerces #​36682
  • Improve principal checks for SockJS session #​36681
  • Set host header consistently in STOMP relay CONNECT frames #​36673
  • Support Micrometer context propagation in Kotlin Flow #​36667
  • Reliable detection of broadcast messages in UserDestinationMessageHandler #​36662

🐞 Bug Fixes

  • Concurrency issue against shared cookie field in CookieLocaleResolver#setLocaleContext #​36869
  • Server Sent Event does not support multi-line comments #​36866
  • CronExpression skips days on midnight DST gap #​36865
  • Regression in 6.2.0+: ConfigurationClassParser incorrectly removes component-scanned bean when the same class is also registered under a different name via XML #​36835
  • Preserve generic type info in awaitEntity() #​36834
  • Bean Background Bootstrap and Lazy Init #​36844
  • Back-off for DefaultMessageListenerContainer with OracleAQ has changed and is very short in SpringBoot 4 #​36809
  • Character outside of permitted range in Content Disposition #​36805
  • Fix JSP tag processing #​36797
  • Fix script processing capabilities #​36795
  • Jaxb2XmlEncoder exclusivity prevents JacksonXmlEncoder usage and hinders POJO serialization #​36776
  • JacksonXmlEncoder.canEncode incorrectly returns true for String body with application/xml #​36775
  • Consistently expose map key quotes in PropertyAccessorUtils #​36765
  • Fix fragment parsing for relative URI in RFC URI parser #​36762
  • Fix race condition in InMemoryWebSessionStore #​36742
  • Parsing failure for MIME type with quoted parameter values #​36730
  • Circular dependency between supplier-created beans is silently ignored on startup #​36725
  • Data is lost for joined DataBuffer in DataBufferUtils #​36714
  • Cache collisions in CachingResourceResolver #​36713
  • Unexpected path element removal when resolving versioned resources #​36698
  • Non-deterministic "Body token not expected" in org.springframework.http.codec.multipart.PartGenerator #​36694
  • Regression on value class parameter handling #​36665
  • Fix inverted logic for boolean last flag in JettyWebSocketSession when sending binary message #​36650
  • Parent traceId is not reused when calling WebClient.awaitExchange function #​36182

📔 Documentation

  • Fix broken links to Selenium documentation #​36875
  • Fix applicability note on setAutoGrowCollectionLimit #​36863
  • Document @Conditional gating of nested @Configuration classes #​36831
  • Javadoc of nestingLevel parameter in MethodParameter constructor is inconsistent with actual implementation #​36826
  • Re-structuring of Data Binding Content in Web Sections of Documentation #​36803
  • Fix typos for validateExistingTransaction #​36767

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​0AndWild, @​Dennis-Mircea, @​cookie-meringue, @​daguimu, @​dmitrysulman, @​kilink, @​kzander91, @​leestana01, @​mguiking, @​quaff, @​seonwooj0810, @​sgerke-1L, @​shenjianeng, @​tianhaocui, @​wushiyuanmaimob, and @​zmovo

Configuration

📅 Schedule: (in timezone Australia/Sydney)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title Update dependency org.springframework:spring-webmvc to v7.0.8 [SECURITY] Update spring.version to v7.0.8 [SECURITY] Aug 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants