org.springframework:spring-webmvc (Maven)
Advisories
86
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.0.9 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.springframework</groupId><artifactId>spring-webmvc</artifactId><version>7.0.9</version></dependency>gradle
implementation("org.springframework:spring-webmvc:7.0.9")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-j9f9-w8pj-32f8 Spring Framework Server Sent Event stream corruption while rendering fragments |
Critical EPSS 0.56% |
>= 7.0.0, < 7.0.9 | 7.0.9 |
| GHSA-j9f9-w8pj-32f8 Spring Framework Server Sent Event stream corruption while rendering fragments |
Critical EPSS 0.56% |
>= 6.2.0, <= 6.2.19 | No fix yet |
| GHSA-pc63-qcmh-9cmg Spring Framework Improper Path Limitation in XsltView |
Critical EPSS 0.60% |
>= 6.0.0, <= 6.0.30 | No fix yet |
| GHSA-pc63-qcmh-9cmg Spring Framework Improper Path Limitation in XsltView |
Critical EPSS 0.60% |
>= 6.1.0, <= 6.1.28 | No fix yet |
| GHSA-pc63-qcmh-9cmg Spring Framework Improper Path Limitation in XsltView |
Critical EPSS 0.60% |
>= 7.0.0, < 7.0.9 | 7.0.9 |
| GHSA-pc63-qcmh-9cmg Spring Framework Improper Path Limitation in XsltView |
Critical EPSS 0.60% |
<= 5.2.25.RELEASE | No fix yet |
| GHSA-pc63-qcmh-9cmg Spring Framework Improper Path Limitation in XsltView |
Critical EPSS 0.60% |
>= 5.3.0, <= 5.3.49 | No fix yet |
| GHSA-pc63-qcmh-9cmg Spring Framework Improper Path Limitation in XsltView |
Critical EPSS 0.60% |
>= 6.2.0, <= 6.2.19 | No fix yet |
| GHSA-cjpg-rgq5-fr37 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux |
Medium EPSS 0.19% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-cjpg-rgq5-fr37 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux |
Medium EPSS 0.19% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-cjpg-rgq5-fr37 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux |
Medium EPSS 0.19% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-cjpg-rgq5-fr37 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux |
Medium EPSS 0.19% |
<= 5.3.39 | No fix yet |
| GHSA-957g-f97v-vppc Spring Framework Cross-site Scripting via JSP Form Tags |
Medium EPSS 0.15% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-957g-f97v-vppc Spring Framework Cross-site Scripting via JSP Form Tags |
Medium EPSS 0.15% |
<= 5.3.39 | No fix yet |
| GHSA-957g-f97v-vppc Spring Framework Cross-site Scripting via JSP Form Tags |
Medium EPSS 0.15% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-957g-f97v-vppc Spring Framework Cross-site Scripting via JSP Form Tags |
Medium EPSS 0.15% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-3chg-m5w7-qfv5 Spring Framework Cross-site Scripting via JavaScriptUtils |
Medium EPSS 0.16% |
<= 5.3.39 | No fix yet |
| GHSA-3chg-m5w7-qfv5 Spring Framework Cross-site Scripting via JavaScriptUtils |
Medium EPSS 0.16% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-3chg-m5w7-qfv5 Spring Framework Cross-site Scripting via JavaScriptUtils |
Medium EPSS 0.16% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-3chg-m5w7-qfv5 Spring Framework Cross-site Scripting via JavaScriptUtils |
Medium EPSS 0.16% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-h3qp-gqrc-q736 Spring Framework Open Redirect in Spring MVC and WebFlux |
Medium EPSS 0.14% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-h3qp-gqrc-q736 Spring Framework Open Redirect in Spring MVC and WebFlux |
Medium EPSS 0.14% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-h3qp-gqrc-q736 Spring Framework Open Redirect in Spring MVC and WebFlux |
Medium EPSS 0.14% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-h3qp-gqrc-q736 Spring Framework Open Redirect in Spring MVC and WebFlux |
Medium EPSS 0.14% |
<= 5.3.39 | No fix yet |
| GHSA-72pg-x5f8-j25j Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux |
Medium EPSS 0.37% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-72pg-x5f8-j25j Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux |
Medium EPSS 0.37% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-72pg-x5f8-j25j Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux |
Medium EPSS 0.37% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-72pg-x5f8-j25j Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux |
Medium EPSS 0.37% |
<= 5.3.39 | No fix yet |
| GHSA-x23c-287f-qqv5 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux |
High EPSS 0.40% |
<= 5.3.39 | No fix yet |
| GHSA-x23c-287f-qqv5 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux |
High EPSS 0.40% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-x23c-287f-qqv5 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux |
High EPSS 0.40% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-x23c-287f-qqv5 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux |
High EPSS 0.40% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-mq64-j8f9-9gcj Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux |
Medium EPSS 0.34% |
>= 7.0.0, < 7.0.8 | 7.0.8 |
| GHSA-mq64-j8f9-9gcj Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux |
Medium EPSS 0.34% |
<= 5.3.39 | No fix yet |
| GHSA-mq64-j8f9-9gcj Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux |
Medium EPSS 0.34% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-mq64-j8f9-9gcj Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux |
Medium EPSS 0.34% |
>= 6.2.0, < 6.2.19 | 6.2.19 |
| GHSA-6p4f-wcwh-5vvm Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources |
Medium EPSS 0.34% |
>= 6.2.0, < 6.2.18 | 6.2.18 |
| GHSA-6p4f-wcwh-5vvm Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources |
Medium EPSS 0.34% |
<= 5.3.47 | No fix yet |
| GHSA-6p4f-wcwh-5vvm Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources |
Medium EPSS 0.34% |
>= 6.1.0, <= 6.1.26 | No fix yet |
| GHSA-6p4f-wcwh-5vvm Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources |
Medium EPSS 0.34% |
>= 7.0.0, < 7.0.7 | 7.0.7 |
| GHSA-wg35-8jpf-2xv3 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. |
Low EPSS 0.24% |
>= 7.0.0, < 7.0.7 | 7.0.7 |
| GHSA-wg35-8jpf-2xv3 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. |
Low EPSS 0.24% |
>= 6.2.0, < 6.2.18 | 6.2.18 |
| GHSA-wg35-8jpf-2xv3 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. |
Low EPSS 0.24% |
>= 6.1.0, <= 6.1.26 | No fix yet |
| GHSA-wg35-8jpf-2xv3 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. |
Low EPSS 0.24% |
<= 5.3.47 | No fix yet |
| GHSA-4773-3jfm-qmx3 Spring Framework Improper Path Limitation with Script View Templates |
Medium EPSS 0.40% |
>= 7.0.0-M1, < 7.0.6 | 7.0.6 |
| GHSA-4773-3jfm-qmx3 Spring Framework Improper Path Limitation with Script View Templates |
Medium EPSS 0.40% |
>= 5.3.0, <= 5.3.39 | No fix yet |
| GHSA-4773-3jfm-qmx3 Spring Framework Improper Path Limitation with Script View Templates |
Medium EPSS 0.40% |
>= 6.0.0, <= 6.1.21 | No fix yet |
| GHSA-4773-3jfm-qmx3 Spring Framework Improper Path Limitation with Script View Templates |
Medium EPSS 0.40% |
>= 6.2.0, < 6.2.17 | 6.2.17 |
| GHSA-6hcq-hmm3-jj3c Spring MVC and WebFlux has Server Sent Event stream corruption |
Low EPSS 0.12% |
>= 6.0.0, <= 6.1.21 | No fix yet |
| GHSA-6hcq-hmm3-jj3c Spring MVC and WebFlux has Server Sent Event stream corruption |
Low EPSS 0.12% |
>= 7.0.0-M1, < 7.0.6 | 7.0.6 |
| GHSA-6hcq-hmm3-jj3c Spring MVC and WebFlux has Server Sent Event stream corruption |
Low EPSS 0.12% |
>= 6.2.0, < 6.2.17 | 6.2.17 |
| GHSA-6hcq-hmm3-jj3c Spring MVC and WebFlux has Server Sent Event stream corruption |
Low EPSS 0.12% |
>= 5.3.0, <= 5.3.39 | No fix yet |
| GHSA-r936-gwx5-v52f Spring Framework MVC Applications Path Traversal Vulnerability |
Medium EPSS 2.13% |
>= 6.0.0, <= 6.0.29 | No fix yet |
| GHSA-r936-gwx5-v52f Spring Framework MVC Applications Path Traversal Vulnerability |
Medium EPSS 2.13% |
>= 5.3.0, <= 5.3.43 | No fix yet |
| GHSA-r936-gwx5-v52f Spring Framework MVC Applications Path Traversal Vulnerability |
Medium EPSS 2.13% |
>= 6.1.0, <= 6.1.21 | No fix yet |
| GHSA-r936-gwx5-v52f Spring Framework MVC Applications Path Traversal Vulnerability |
Medium EPSS 2.13% |
>= 6.2.0, < 6.2.10 | 6.2.10 |
| GHSA-g5vr-rgqm-vf78 Spring Framework Path Traversal vulnerability |
High EPSS 56.04% |
<= 5.3.40 | No fix yet |
| GHSA-g5vr-rgqm-vf78 Spring Framework Path Traversal vulnerability |
High EPSS 56.04% |
>= 6.0.0, <= 6.0.24 | No fix yet |
| GHSA-g5vr-rgqm-vf78 Spring Framework Path Traversal vulnerability |
High EPSS 56.04% |
>= 6.1.0, < 6.1.14 | 6.1.14 |
| GHSA-w3c8-7r8f-9jp8 Spring MVC controller vulnerable to a DoS attack |
Medium EPSS 0.72% |
>= 5.3.0, < 5.3.42 | 5.3.42 |
| GHSA-cx7f-g6mp-7hqm Path traversal vulnerability in functional web frameworks |
High EPSS 21.26% |
>= 5.3.0, <= 5.3.39 | No fix yet |
| GHSA-cx7f-g6mp-7hqm Path traversal vulnerability in functional web frameworks |
High EPSS 21.26% |
>= 6.0.0, <= 6.0.23 | No fix yet |
| GHSA-cx7f-g6mp-7hqm Path traversal vulnerability in functional web frameworks |
High EPSS 21.26% |
>= 6.1.0, < 6.1.13 | 6.1.13 |
| GHSA-v94h-hvhg-mf9h Spring Framework vulnerable to denial of service |
High EPSS 1.16% |
>= 6.0.0, < 6.0.14 | 6.0.14 |
| GHSA-7phw-cxx7-q9vq Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch |
High EPSS 3.51% |
>= 6.0.0, < 6.0.7 | 6.0.7 |
| GHSA-7phw-cxx7-q9vq Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch |
High EPSS 3.51% |
>= 5.3.0, < 5.3.26 | 5.3.26 |
| GHSA-ff7p-jqjm-v66h Improper Neutralization of Input During Web Page Generation in Spring Framework |
Medium EPSS 6.90% |
>= 3.0.0, < 3.2.8.RELEASE | 3.2.8.RELEASE |
| GHSA-ff7p-jqjm-v66h Improper Neutralization of Input During Web Page Generation in Spring Framework |
Medium EPSS 6.90% |
>= 4.0.0, < 4.0.2.RELEASE | 4.0.2.RELEASE |
| GHSA-f93f-g33r-8pcp Improper Restriction of XML External Entity Reference in Spring Framework |
High EPSS 1.47% |
>= 3.0.0, < 3.2.8 | 3.2.8 |
| GHSA-hhm4-hwq6-3c6w Improper Limitation of a Pathname to a Restricted Directory in Spring Framework |
Medium EPSS 9.93% |
>= 3.0.4, < 3.2.12 | 3.2.12 |
| GHSA-hhm4-hwq6-3c6w Improper Limitation of a Pathname to a Restricted Directory in Spring Framework |
Medium EPSS 9.93% |
>= 4.0.0, < 4.0.8 | 4.0.8 |
| GHSA-hhm4-hwq6-3c6w Improper Limitation of a Pathname to a Restricted Directory in Spring Framework |
Medium EPSS 9.93% |
>= 4.1.0, < 4.1.2 | 4.1.2 |
| GHSA-f93f-g33r-8pcp Improper Restriction of XML External Entity Reference in Spring Framework |
High EPSS 1.47% |
>= 4.0.0, < 4.0.5 | 4.0.5 |
| GHSA-8cmm-qj8g-fcp6 Cross-Site Request Forgery in Spring Framework |
Medium EPSS 91.35% |
< 3.2.8 | 3.2.8 |
| GHSA-8cmm-qj8g-fcp6 Cross-Site Request Forgery in Spring Framework |
Medium EPSS 91.35% |
>= 4.0.0, < 4.0.2 | 4.0.2 |
| GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework Known exploited |
Critical EPSS 99.64% |
< 5.2.20.RELEASE | 5.2.20.RELEASE |
| GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework Known exploited |
Critical EPSS 99.64% |
>= 5.3.0, < 5.3.18 | 5.3.18 |
| GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework Known exploited |
Critical EPSS 99.64% |
< 5.2.20.RELEASE | 5.2.20.RELEASE |
| GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework Known exploited |
Critical EPSS 99.64% |
>= 5.3.0, < 5.3.18 | 5.3.18 |
| GHSA-7pm4-g2qj-j85x CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux |
Medium EPSS 2.55% |
>= 5.2.0, < 5.2.3 | 5.2.3 |
| GHSA-8wx2-9q48-vm9r RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application |
High EPSS 88.32% |
>= 5.2.0.RELEASE, < 5.2.3.RELEASE | 5.2.3.RELEASE |
| GHSA-8wx2-9q48-vm9r RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application |
High EPSS 88.32% |
>= 5.1.0.RELEASE, < 5.1.13.RELEASE | 5.1.13.RELEASE |
| GHSA-8wx2-9q48-vm9r RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application |
High EPSS 88.32% |
>= 5.0.0.RELEASE, < 5.0.16.RELEASE | 5.0.16.RELEASE |
| GHSA-2m8h-fgr8-2q9w Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized |
High EPSS 4.91% |
< 3.2.18 | 3.2.18 |
| GHSA-2m8h-fgr8-2q9w Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized |
High EPSS 4.91% |
>= 4.2.0, < 4.2.9 | 4.2.9 |
| GHSA-2m8h-fgr8-2q9w Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized |
High EPSS 4.91% |
>= 4.3.0, < 4.3.5 | 4.3.5 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor