VulertSecurity VulertSecurity

Vulnerability Database · Search

org.springframework:spring-core vulnerabilities — 18 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
3.7 low CVE-2026-41848: Spring Framework Denial of Service via AntPathMatcher org.springframework:spring-core Maven 09 Jun 2026 7.0.8
7.5 high CVE-2025-41249: Spring Framework Improper Authorization via Annotation Detection org.springframework:spring-core Maven 16 Sep 2025 No fix published
7.5 high CVE-2024-22233: Spring Framework server Web DoS Vulnerability in org.springframework:spring-core org.springframework:spring-core Maven 22 Jan 2024 6.1.3
4.3 medium CVE-2021-22096: Improper Output Neutralization for Logs in Spring Framework org.springframework:spring-core Maven 24 May 2022 5.3.11
High CVE-2011-2730: Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework org.springframework:spring-core Maven 17 May 2022 3.0.6
Medium CVE-2011-2894: Spring Framework and Spring Security Deserialization of Untrusted Data org.springframework:spring-core Maven 14 May 2022 3.0.6
Medium CVE-2014-3578: Improper Limitation of a Pathname to a Restricted Directory in Spring Framework org.springframework:spring-core Maven 14 May 2022 3.2.9
Medium CVE-2009-1190: Spring Framework Inefficient Regular Expression Complexity org.springframework:spring-core Maven 02 May 2022 3.0.0.RELEASE
4.3 medium CVE-2021-22060: Log Entry Injection in Spring Framework org.springframework:spring-core Maven 12 Jan 2022 5.3.14
7.5 high CVE-2018-15756: Denial of Service in Spring Framework org.springframework:spring-core Maven 15 Jun 2020 5.1.1.RELEASE
7.5 high CVE-2016-5007: Spring Security and Spring Framework Path Recognition Vulnerability org.springframework:spring-core Maven 17 Oct 2018 4.3.1
8.6 high CVE-2015-5211: Files or Directories Accessible to External Parties in org.springframework:spring-core org.springframework:spring-core Maven 17 Oct 2018 4.2.2
Medium CVE-2015-0201: Vulnerability in org.springframework:spring-core org.springframework:spring-core Maven 17 Oct 2018 4.1.5
7.5 high CVE-2018-1272: Privilege Escalation in org.springframework:spring-core org.springframework:spring-core Maven 17 Oct 2018 4.3.15
5.9 medium CVE-2018-1271: Path Traversal in org.springframework:spring-core org.springframework:spring-core Maven 17 Oct 2018 5.0.5
8.8 high CVE-2018-1258: Authorization Bypass in Spring Framework org.springframework:spring-core Maven 17 Oct 2018 5.0.6.RELEASE
6.5 medium CVE-2018-1257: Denial of Service in org.springframework:spring-core org.springframework:spring-core Maven 17 Oct 2018 5.0.6
5.9 medium CVE-2018-11040: Vulnerability in org.springframework:spring-core org.springframework:spring-core Maven 16 Oct 2018 5.0.7.RELEASE
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.