Spring Spring Framework

Name: Spring Spring Framework
Brand: Spring

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

1critical6high7medium0low

updated 2026-10-27

vulnerabilities (28)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2020-5398US	high7.5OT high	88.3% (100th)	Exploit	v5.0.16.RELEASE	2020-01-17	3 versions
CVE-2024-22243US	—	3.97% (90th)	Exploit	5.3.32	2024-02-23	4 versions
CVE-2024-22262US	—	1.19% (68th)	Exploit	6.1.6	2024-04-16	4 versions
CVE-2024-22259US	—	2.57% (85th)	—	5.3.33	2024-03-16	4 versions
CVE-2020-5397US	medium5.3	2.55% (85th)	—	v5.2.3.RELEASE	2020-01-17	5.2 → v5.2.3.RELEASE
CVE-2023-34053US	high7.5	1.16% (67th)	—	6.0.14	2023-11-28	6.0.0 → 6.0.14
CVE-2024-22233US	high7.5	1.05% (64th)	—	no fix	2024-01-22	3 versions
CVE-2024-38808US	—	0.57% (47th)	—	5.3.39, 6.0+	2024-08-20	5.3.0 → 5.3.39, 6.0+
CVE-2025-22233US	—	0.43% (37th)	—	5.3.43	2025-05-16	8 versions
CVE-2026-22737US	—	0.40% (34th)	—	no fix	2026-03-20	4 versions
CVE-2026-41842US	—	0.40% (34th)	—	5.3.49	2026-06-09	4 versions
CVE-2026-41851US	high7.5	0.39% (33rd)	—	6.2.18.1	2026-06-09	4 versions
CVE-2026-41850US	—	0.39% (33rd)	—	5.3.49	2026-06-09	4 versions
CVE-2026-41843US	—	0.37% (31st)	—	6.2.18.1	2026-06-09	4 versions
CVE-2026-41841US	—	0.34% (27th)	—	7.0.7.1	2026-06-09	4 versions
CVE-2026-41848US	high7.5	0.34% (27th)	—	5.3.49	2026-06-09	4 versions
CVE-2026-41855US	critical9.8	0.33% (26th)	—	5.3.49	2026-06-09	4 versions
CVE-2026-41840US	—	0.27% (19th)	—	6.2.18.1	2026-06-09	4 versions
CVE-2026-41849US	—	0.26% (18th)	—	5.3.49	2026-06-09	5.3.0 → 5.3.49
CVE-2026-41839US	—	0.21% (11th)	—	6.2.18.1	2026-06-09	4 versions
CVE-2026-41853US	—	0.19% (8th)	—	5.3.49	2026-06-09	4 versions
CVE-2026-41852US	medium5.3OT elevated	0.18% (7th)	—	6.2.18.1	2026-06-09	4 versions
CVE-2026-41838US	high7.5OT elevated	0.17% (6th)	—	7.0.7.1	2026-06-09	4 versions
CVE-2026-41847US	medium5.3	0.17% (6th)	—	5.3.49	2026-06-09	5.3.0 → 5.3.49
CVE-2026-41845US	medium6.1	0.16% (5th)	—	7.0.7.1	2026-06-09	4 versions
CVE-2026-41846US	medium6.1	0.15% (4th)	—	5.3.49	2026-06-09	4 versions
CVE-2026-41844US	medium6.1	0.14% (4th)	—	6.2.18.1	2026-06-09	4 versions
CVE-2026-41854US	medium6.5	0.12% (2nd)	—	6.2.18.1	2026-06-09	2 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-400Uncontrolled Resource Consumption4 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')4 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-918Server-Side Request Forgery (SSRF)3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-404Improper Resource Shutdown or Release2 CVEs
CWE-770Allocation of Resources Without Limits or Throttling2 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)28 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan