org.springframework:spring-core (Maven)
Advisories
39
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.0.8 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.springframework</groupId><artifactId>spring-core</artifactId><version>7.0.8</version></dependency>gradle
implementation("org.springframework:spring-core:7.0.8")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-659m-px2c-25wj Spring Framework Denial of Service via AntPathMatcher |
High EPSS 0.34% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-659m-px2c-25wj Spring Framework Denial of Service via AntPathMatcher |
High EPSS 0.34% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-659m-px2c-25wj Spring Framework Denial of Service via AntPathMatcher |
High EPSS 0.34% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-659m-px2c-25wj Spring Framework Denial of Service via AntPathMatcher |
High EPSS 0.34% |
<= 5.3.39 | No fix yet |
| GHSA-jmp9-x22r-554x Spring Framework annotation detection mechanism may result in improper authorization |
High EPSS 0.48% |
>= 6.2.0, < 6.2.11 | 6.2.11 |
| GHSA-jmp9-x22r-554x Spring Framework annotation detection mechanism may result in improper authorization |
High EPSS 0.48% |
>= 5.3.0, <= 5.3.44 | No fix yet |
| GHSA-jmp9-x22r-554x Spring Framework annotation detection mechanism may result in improper authorization |
High EPSS 0.48% |
>= 6.0.0, <= 6.1.22 | No fix yet |
| GHSA-r4q3-7g4q-x89m Spring Framework server Web DoS Vulnerability |
High EPSS 1.05% |
>= 6.1.2, < 6.1.3 | 6.1.3 |
| GHSA-r4q3-7g4q-x89m Spring Framework server Web DoS Vulnerability |
High EPSS 1.05% |
>= 6.0.15, < 6.0.16 | 6.0.16 |
| GHSA-rfmp-97jj-h8m6 Improper Output Neutralization for Logs in Spring Framework |
Medium EPSS 1.35% |
>= 5.2.0, < 5.2.18 | 5.2.18 |
| GHSA-rfmp-97jj-h8m6 Improper Output Neutralization for Logs in Spring Framework |
Medium EPSS 1.35% |
>= 5.3.0, < 5.3.11 | 5.3.11 |
| GHSA-wv88-pf73-x22p Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework |
High EPSS 11.78% |
< 2.5.6.SEC03 | 2.5.6.SEC03 |
| GHSA-wv88-pf73-x22p Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework |
High EPSS 11.78% |
>= 2.5.7.SR0, < 2.5.7.SR023 | 2.5.7.SR023 |
| GHSA-wv88-pf73-x22p Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework |
High EPSS 11.78% |
>= 3.0.0, < 3.0.6 | 3.0.6 |
| GHSA-f866-m9mv-2xr3 Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data |
Medium EPSS 8.60% |
>= 3.0.0, < 3.0.6 | 3.0.6 |
| GHSA-rhcg-rwhx-qj3j Improper Limitation of a Pathname to a Restricted Directory in Spring Framework |
Medium EPSS 6.39% |
>= 3.0.0, < 3.2.9 | 3.2.9 |
| GHSA-rhcg-rwhx-qj3j Improper Limitation of a Pathname to a Restricted Directory in Spring Framework |
Medium EPSS 6.39% |
>= 4.0.0, < 4.0.5 | 4.0.5 |
| GHSA-wjjr-h4wh-w6vv Spring Framework Inefficient Regular Expression Complexity |
Medium EPSS 2.80% |
>= 1.1.0, < 3.0.0.RELEASE | 3.0.0.RELEASE |
| GHSA-6gf2-pvqw-37ph Log entry injection in Spring Framework |
Medium EPSS 0.91% |
>= 5.2.0, < 5.2.19 | 5.2.19 |
| GHSA-6gf2-pvqw-37ph Log entry injection in Spring Framework |
Medium EPSS 0.91% |
>= 5.3.0, < 5.3.14 | 5.3.14 |
| GHSA-ffvq-7w96-97p7 Denial of Service in Spring Framework |
High EPSS 8.80% |
>= 4.2.0.RELEASE, < 4.3.20.RELEASE | 4.3.20.RELEASE |
| GHSA-ffvq-7w96-97p7 Denial of Service in Spring Framework |
High EPSS 8.80% |
>= 5.1.0.RELEASE, < 5.1.1.RELEASE | 5.1.1.RELEASE |
| GHSA-ffvq-7w96-97p7 Denial of Service in Spring Framework |
High EPSS 8.80% |
>= 5.0.0.RELEASE, < 5.0.10.RELEASE | 5.0.10.RELEASE |
| GHSA-8crv-49fr-2h6j Spring Security and Spring Framework may not recognize certain paths that should be protected |
High EPSS 2.80% |
< 4.3.1 | 4.3.1 |
| GHSA-pgf9-h69p-pcgf Files or Directories Accessible to External Parties in org.springframework:spring-core |
High EPSS 2.56% |
< 3.2.15 | 3.2.15 |
| GHSA-pgf9-h69p-pcgf Files or Directories Accessible to External Parties in org.springframework:spring-core |
High EPSS 2.56% |
>= 4.2.0, < 4.2.2 | 4.2.2 |
| GHSA-pgf9-h69p-pcgf Files or Directories Accessible to External Parties in org.springframework:spring-core |
High EPSS 2.56% |
>= 4.0.0, < 4.1.8 | 4.1.8 |
| GHSA-45vg-2v73-vm62 Moderate severity vulnerability that affects org.springframework:spring-core |
Medium EPSS 1.90% |
>= 4.1.0, < 4.1.5 | 4.1.5 |
| GHSA-4487-x383-qpph Possible privilege escalation in org.springframework:spring-core |
High EPSS 3.06% |
< 4.3.15 | 4.3.15 |
| GHSA-4487-x383-qpph Possible privilege escalation in org.springframework:spring-core |
High EPSS 3.06% |
>= 5.0.0, < 5.0.5 | 5.0.5 |
| GHSA-g8hw-794c-4j9g Path Traversal in org.springframework:spring-core |
Medium EPSS 30.34% |
< 4.3.15 | 4.3.15 |
| GHSA-g8hw-794c-4j9g Path Traversal in org.springframework:spring-core |
Medium EPSS 30.34% |
>= 5.0.0, < 5.0.5 | 5.0.5 |
| GHSA-cxrj-66c5-9fmh Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass |
High EPSS 2.46% |
>= 5.0.5.RELEASE, < 5.0.6.RELEASE | 5.0.6.RELEASE |
| GHSA-rcpf-vj53-7h2m Denial of Service in org.springframework:spring-core |
Medium EPSS 3.02% |
< 4.3.17 | 4.3.17 |
| GHSA-rcpf-vj53-7h2m Denial of Service in org.springframework:spring-core |
Medium EPSS 3.02% |
>= 5.0.0, < 5.0.6 | 5.0.6 |
| GHSA-v596-fwhq-8x48 Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core |
Medium EPSS 2.80% |
>= 5.0.0, < 5.0.3 | 5.0.3 |
| GHSA-v596-fwhq-8x48 Improper Input Validation in org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core |
Medium EPSS 2.80% |
>= 4.3.0, < 4.3.14 | 4.3.14 |
| GHSA-f26x-pr96-vw86 Moderate severity vulnerability that affects org.springframework:spring-core |
Medium EPSS 3.23% |
>= 5.0.0.RELEASE, < 5.0.7.RELEASE | 5.0.7.RELEASE |
| GHSA-f26x-pr96-vw86 Moderate severity vulnerability that affects org.springframework:spring-core |
Medium EPSS 3.23% |
>= 4.3.0.RELEASE, < 4.3.18.RELEASE | 4.3.18.RELEASE |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor