Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Spring Web component can be exploited to bypass security

CVE-2016-1000027 · published 6 days ago
Summary

Certain versions of the Spring Web library contain a flaw that could allow an attacker to run unauthorized actions on your application. This affects the Spring Web packages used in many Java environments, including those provided by Spring Framework, VMware, Root, and Debian. Upgrade to the latest patched version of Spring Web as soon as possible to protect your systems.

What to do
  • Update springframework org.springframework:spring-web to version 6.0.0.
  • Update root io.root.org.springframework:spring-web to version 5.3.23-root.io.2.
  • Update root io.root.org.springframework:spring-web to version 5.3.23-root.io.3.
  • Update springframework org.springframework:spring-web to version 5.3.23-aikido.3.
  • Update root io.root.org.springframework:spring-web to version 5.3.23-root.io.4.
  • Update springframework org.springframework:spring-web to version 5.3.23-aikido.4.
  • Update springframework org.springframework:spring-web to version 5.3.23-aikido.6.
  • Update root io.root.org.springframework:spring-web to version 5.3.23-root.io.6.
  • Update debian libspring-java to version 4.2.7-1.
  • Update org.springframework:spring-web to version 5.3.23-aikido.6.
  • Update io.root.org.springframework:spring-web to version 5.3.23-root.io.6.
  • Update org.springframework:spring-web to version 5.3.31-aikido.5.
  • Update io.root.org.springframework:spring-web to version 5.3.31-root.io.5.
  • Update org.springframework:spring-web to version 4.0.3.RELEASE-aikido.3.
  • Update io.root.org.springframework:spring-web to version 4.0.3.RELEASE-root.io.3.
  • Update org.springframework:spring-web to version 4.0.3.RELEASE-aikido.4.
  • Update io.root.org.springframework:spring-web to version 4.0.3.RELEASE-root.io.4.
  • Update org.springframework:spring-web to version 5.3.31-aikido.6.
  • Update io.root.org.springframework:spring-web to version 5.3.31-root.io.6.
  • Update org.springframework:spring-web to version 4.0.3.RELEASE-aikido.5.
  • Update io.root.org.springframework:spring-web to version 4.0.3.RELEASE-root.io.5.
  • Update org.springframework:spring-web to version 4.0.3.RELEASE-aikido.6.
  • Update io.root.org.springframework:spring-web to version 4.0.3.RELEASE-root.io.6.
  • Update org.springframework:spring-web to version 5.3.20-aikido.8.
  • Update io.root.org.springframework:spring-web to version 5.3.20-root.io.8.
  • Update org.springframework:spring-web to version 5.3.14-aikido.8.
  • Update io.root.org.springframework:spring-web to version 5.3.14-root.io.8.
  • Update org.springframework:spring-web to version 4.0.3.RELEASE-aikido.7.
  • Update io.root.org.springframework:spring-web to version 4.0.3.RELEASE-root.io.7.
  • Update org.springframework:spring-web to version 4.0.3.RELEASE-aikido.8.
  • Update io.root.org.springframework:spring-web to version 4.0.3.RELEASE-root.io.8.
  • Update org.springframework:spring-web to version 4.3.13.RELEASE-aikido.1.
  • Update io.root.org.springframework:spring-web to version 4.3.13.RELEASE-root.io.1.
  • Update vmware spring_framework to version 6.0.0 or later.
Affected software
Ecosystem VendorProductAffected versions
maven springframework org.springframework:spring-web < 6.0.0
Fix: upgrade to 6.0.0
– vmware spring_framework < 6.0.0
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
Root:Maven root io.root.org.springframework:spring-web < 5.3.23-root.io.2
< 5.3.23-root.io.3
< 5.3.23-root.io.4
< 5.3.23-root.io.6
Fix: upgrade to 5.3.23-root.io.2
Root:Maven springframework org.springframework:spring-web < 5.3.23-aikido.3
< 5.3.23-aikido.4
< 5.3.23-aikido.6
Fix: upgrade to 5.3.23-aikido.3
Debian:12 debian libspring-java < 4.2.7-1
Fix: upgrade to 4.2.7-1
Debian:13 debian libspring-java < 4.2.7-1
Fix: upgrade to 4.2.7-1
Debian:14 debian libspring-java < 4.2.7-1
Fix: upgrade to 4.2.7-1
Root:Maven – org.springframework:spring-web < 5.3.23-aikido.6
< 5.3.31-aikido.5
< 4.0.3.RELEASE-aikido.3
< 4.0.3.RELEASE-aikido.4
< 5.3.31-aikido.6
< 4.0.3.RELEASE-aikido.5
< 4.0.3.RELEASE-aikido.6
< 5.3.20-aikido.8
< 5.3.14-aikido.8
< 4.0.3.RELEASE-aikido.7
< 4.0.3.RELEASE-aikido.8
< 4.3.13.RELEASE-aikido.1
Fix: upgrade to 5.3.23-aikido.6
Root:Maven – io.root.org.springframework:spring-web < 5.3.23-root.io.6
< 5.3.31-root.io.5
< 4.0.3.RELEASE-root.io.3
< 4.0.3.RELEASE-root.io.4
< 5.3.31-root.io.6
< 4.0.3.RELEASE-root.io.5
< 4.0.3.RELEASE-root.io.6
< 5.3.20-root.io.8
< 5.3.14-root.io.8
< 4.0.3.RELEASE-root.io.7
< 4.0.3.RELEASE-root.io.8
< 4.3.13.RELEASE-root.io.1
Fix: upgrade to 5.3.23-root.io.6
Original advisory text
CVE-2016-1000027 in org.springframework:spring-web - Patched by Root
Root has patched CVE-2016-1000027 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
33% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published9 Nov 2026
Updated9 Nov 2026
First seen6 Mar 2026
Sources
GHSA-4wrc-f8pq-fpqp · GHSA
CVE-2016-1000027 · NVD
ROOT-APP-MAVEN-CVE-2016-1000027 · OSV
DEBIAN-CVE-2016-1000027 · OSV
CVE-2016-1000027 · MITRE
Track software like this
Free during beta