org.springframework:spring-webflux (Maven)
Advisories
71
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.0.9 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.springframework</groupId><artifactId>spring-webflux</artifactId><version>7.0.9</version></dependency>gradle
implementation("org.springframework:spring-webflux:7.0.9")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-9qf2-26p9-2q2q Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints |
Critical EPSS 0.53% |
>= 5.2.5.RELEASE, <= 5.2.25.RELEASE | No fix yet |
| GHSA-9qf2-26p9-2q2q Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints |
Critical EPSS 0.53% |
>= 7.0.0, < 7.0.9 | 7.0.9 |
| GHSA-9qf2-26p9-2q2q Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints |
Critical EPSS 0.53% |
>= 6.2.0, <= 6.2.19 | No fix yet |
| GHSA-9qf2-26p9-2q2q Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints |
Critical EPSS 0.53% |
>= 6.1.0, <= 6.1.28 | No fix yet |
| GHSA-9qf2-26p9-2q2q Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints |
Critical EPSS 0.53% |
>= 6.0.0, <= 6.0.30 | No fix yet |
| GHSA-9qf2-26p9-2q2q Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints |
Critical EPSS 0.53% |
>= 5.3.0, <= 5.3.49 | No fix yet |
| GHSA-j9f9-w8pj-32f8 Spring Framework Server Sent Event stream corruption while rendering fragments |
Critical EPSS 0.56% |
>= 7.0.0, < 7.0.9 | 7.0.9 |
| GHSA-j9f9-w8pj-32f8 Spring Framework Server Sent Event stream corruption while rendering fragments |
Critical EPSS 0.56% |
>= 6.2.0, <= 6.2.19 | No fix yet |
| GHSA-cjpg-rgq5-fr37 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux |
Medium EPSS 0.19% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-cjpg-rgq5-fr37 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux |
Medium EPSS 0.19% |
<= 5.3.39 | No fix yet |
| GHSA-cjpg-rgq5-fr37 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux |
Medium EPSS 0.19% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-cjpg-rgq5-fr37 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux |
Medium EPSS 0.19% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-vqgp-pf68-6947 Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL |
Medium EPSS 0.17% |
<= 5.3.39 | No fix yet |
| GHSA-h3qp-gqrc-q736 Spring Framework Open Redirect in Spring MVC and WebFlux |
Medium EPSS 0.14% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-h3qp-gqrc-q736 Spring Framework Open Redirect in Spring MVC and WebFlux |
Medium EPSS 0.14% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-h3qp-gqrc-q736 Spring Framework Open Redirect in Spring MVC and WebFlux |
Medium EPSS 0.14% |
<= 5.3.39 | No fix yet |
| GHSA-h3qp-gqrc-q736 Spring Framework Open Redirect in Spring MVC and WebFlux |
Medium EPSS 0.14% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-72pg-x5f8-j25j Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux |
Medium EPSS 0.37% |
<= 5.3.39 | No fix yet |
| GHSA-72pg-x5f8-j25j Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux |
Medium EPSS 0.37% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-72pg-x5f8-j25j Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux |
Medium EPSS 0.37% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-72pg-x5f8-j25j Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux |
Medium EPSS 0.37% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-x23c-287f-qqv5 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux |
High EPSS 0.40% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-x23c-287f-qqv5 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux |
High EPSS 0.40% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-x23c-287f-qqv5 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux |
High EPSS 0.40% |
<= 5.3.39 | No fix yet |
| GHSA-x23c-287f-qqv5 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux |
High EPSS 0.40% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-mq64-j8f9-9gcj Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux |
Medium EPSS 0.34% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-mq64-j8f9-9gcj Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux |
Medium EPSS 0.34% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-mq64-j8f9-9gcj Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux |
Medium EPSS 0.34% |
<= 5.3.39 | No fix yet |
| GHSA-mq64-j8f9-9gcj Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux |
Medium EPSS 0.34% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-83f7-v6px-pp3h Spring Framework Denial of Service via Multipart Requests in WebFlux |
Medium EPSS 0.27% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-83f7-v6px-pp3h Spring Framework Denial of Service via Multipart Requests in WebFlux |
Medium EPSS 0.27% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-83f7-v6px-pp3h Spring Framework Denial of Service via Multipart Requests in WebFlux |
Medium EPSS 0.27% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-83f7-v6px-pp3h Spring Framework Denial of Service via Multipart Requests in WebFlux |
Medium EPSS 0.27% |
<= 5.3.39 | No fix yet |
| GHSA-4hfh-6x8g-gwpp Spring Framework Escalation via Session Fixation in WebFlux |
Medium EPSS 0.21% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-4hfh-6x8g-gwpp Spring Framework Escalation via Session Fixation in WebFlux |
Medium EPSS 0.21% |
<= 5.3.39 | No fix yet |
| GHSA-4hfh-6x8g-gwpp Spring Framework Escalation via Session Fixation in WebFlux |
Medium EPSS 0.21% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-4hfh-6x8g-gwpp Spring Framework Escalation via Session Fixation in WebFlux |
Medium EPSS 0.21% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-6p4f-wcwh-5vvm Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources |
Medium EPSS 0.34% |
>= 6.2.0, < 6.2.18 | 6.2.18 |
| GHSA-6p4f-wcwh-5vvm Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources |
Medium EPSS 0.34% |
>= 7.0.0, < 7.0.7 | 7.0.7 |
| GHSA-6p4f-wcwh-5vvm Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources |
Medium EPSS 0.34% |
<= 5.3.47 | No fix yet |
| GHSA-6p4f-wcwh-5vvm Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources |
Medium EPSS 0.34% |
>= 6.1.0, <= 6.1.26 | No fix yet |
| GHSA-wg35-8jpf-2xv3 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. |
Low EPSS 0.24% |
>= 7.0.0, < 7.0.7 | 7.0.7 |
| GHSA-wg35-8jpf-2xv3 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. |
Low EPSS 0.24% |
<= 5.3.47 | No fix yet |
| GHSA-wg35-8jpf-2xv3 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. |
Low EPSS 0.24% |
>= 6.1.0, <= 6.1.26 | No fix yet |
| GHSA-wg35-8jpf-2xv3 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. |
Low EPSS 0.24% |
>= 6.2.0, < 6.2.18 | 6.2.18 |
| GHSA-5843-p793-ghmm Spring Framework DoS with Multipart Temp Files in WebFlux |
Medium EPSS 0.34% |
>= 7.0.0, < 7.0.7 | 7.0.7 |
| GHSA-5843-p793-ghmm Spring Framework DoS with Multipart Temp Files in WebFlux |
Medium EPSS 0.34% |
>= 6.2.0, < 6.2.18 | 6.2.18 |
| GHSA-5843-p793-ghmm Spring Framework DoS with Multipart Temp Files in WebFlux |
Medium EPSS 0.34% |
<= 5.3.47 | No fix yet |
| GHSA-5843-p793-ghmm Spring Framework DoS with Multipart Temp Files in WebFlux |
Medium EPSS 0.34% |
>= 6.1.0, <= 6.1.26 | No fix yet |
| GHSA-4773-3jfm-qmx3 Spring Framework Improper Path Limitation with Script View Templates |
Medium EPSS 0.40% |
>= 7.0.0-M1, < 7.0.6 | 7.0.6 |
| GHSA-4773-3jfm-qmx3 Spring Framework Improper Path Limitation with Script View Templates |
Medium EPSS 0.40% |
>= 6.0.0, <= 6.1.21 | No fix yet |
| GHSA-4773-3jfm-qmx3 Spring Framework Improper Path Limitation with Script View Templates |
Medium EPSS 0.40% |
>= 5.3.0, <= 5.3.39 | No fix yet |
| GHSA-4773-3jfm-qmx3 Spring Framework Improper Path Limitation with Script View Templates |
Medium EPSS 0.40% |
>= 6.2.0, < 6.2.17 | 6.2.17 |
| GHSA-6hcq-hmm3-jj3c Spring MVC and WebFlux has Server Sent Event stream corruption |
Low EPSS 0.12% |
>= 6.0.0, <= 6.1.21 | No fix yet |
| GHSA-6hcq-hmm3-jj3c Spring MVC and WebFlux has Server Sent Event stream corruption |
Low EPSS 0.12% |
>= 5.3.0, <= 5.3.39 | No fix yet |
| GHSA-6hcq-hmm3-jj3c Spring MVC and WebFlux has Server Sent Event stream corruption |
Low EPSS 0.12% |
>= 6.2.0, < 6.2.17 | 6.2.17 |
| GHSA-6hcq-hmm3-jj3c Spring MVC and WebFlux has Server Sent Event stream corruption |
Low EPSS 0.12% |
>= 7.0.0-M1, < 7.0.6 | 7.0.6 |
| GHSA-g5vr-rgqm-vf78 Spring Framework Path Traversal vulnerability |
High EPSS 56.04% |
>= 6.0.0, <= 6.0.24 | No fix yet |
| GHSA-g5vr-rgqm-vf78 Spring Framework Path Traversal vulnerability |
High EPSS 56.04% |
>= 6.1.0, < 6.1.14 | 6.1.14 |
| GHSA-g5vr-rgqm-vf78 Spring Framework Path Traversal vulnerability |
High EPSS 56.04% |
<= 5.3.40 | No fix yet |
| GHSA-cx7f-g6mp-7hqm Path traversal vulnerability in functional web frameworks |
High EPSS 21.26% |
>= 6.0.0, <= 6.0.23 | No fix yet |
| GHSA-cx7f-g6mp-7hqm Path traversal vulnerability in functional web frameworks |
High EPSS 21.26% |
>= 6.1.0, < 6.1.13 | 6.1.13 |
| GHSA-cx7f-g6mp-7hqm Path traversal vulnerability in functional web frameworks |
High EPSS 21.26% |
>= 5.3.0, <= 5.3.39 | No fix yet |
| GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework Known exploited |
Critical EPSS 99.64% |
>= 5.3.0, < 5.3.18 | 5.3.18 |
| GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework Known exploited |
Critical EPSS 99.64% |
< 5.2.20.RELEASE | 5.2.20.RELEASE |
| GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework Known exploited |
Critical EPSS 99.64% |
>= 5.3.0, < 5.3.18 | 5.3.18 |
| GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework Known exploited |
Critical EPSS 99.64% |
< 5.2.20.RELEASE | 5.2.20.RELEASE |
| GHSA-7pm4-g2qj-j85x CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux |
Medium EPSS 2.55% |
>= 5.2.0, < 5.2.3 | 5.2.3 |
| GHSA-8wx2-9q48-vm9r RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application |
High EPSS 88.32% |
>= 5.1.0.RELEASE, < 5.1.13.RELEASE | 5.1.13.RELEASE |
| GHSA-8wx2-9q48-vm9r RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application |
High EPSS 88.32% |
>= 5.2.0.RELEASE, < 5.2.3.RELEASE | 5.2.3.RELEASE |
| GHSA-8wx2-9q48-vm9r RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application |
High EPSS 88.32% |
>= 5.0.0.RELEASE, < 5.0.16.RELEASE | 5.0.16.RELEASE |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor