Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Spring Framework packages allow code execution, update now

published 3 months ago

Summary

Several Spring Framework components—including core, web MVC, expression, instrument, and core libraries—contain a security weakness that could let attackers run unwanted code. Updating to version 5.3.31-tuxcare.5 resolves the issue. Apply the TuxCare update as soon as possible to protect your applications.

What to do

Update springframework org.springframework:spring to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-webmvc to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-instrument to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-expression to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-core to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-test to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-jms to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-web to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-context-support to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-orm to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-beans to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-tx to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-oxm to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-context to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-jdbc to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-framework-bom to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-websocket to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-messaging to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-webflux to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-context-indexer to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-jcl to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-r2dbc to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-aop to version 5.3.31-tuxcare.5.
Update springframework org.springframework:spring-aspects to version 5.3.31-tuxcare.5.
Update org.springframework:spring-webflux to version 5.3.31-tuxcare.5.
Update org.springframework:spring-webmvc to version 5.3.31-tuxcare.5.

Affected software

Ecosystem	Vendor	Product	Affected versions
TuxCare:Maven	springframework	org.springframework:spring	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-webmvc	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-instrument	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-expression	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-core	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-test	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-jms	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-web	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-context-support	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-orm	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-beans	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-tx	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-oxm	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-context	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-jdbc	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-framework-bom	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-websocket	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-messaging	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-webflux	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-context-indexer	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-jcl	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-r2dbc	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-aop	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	springframework	org.springframework:spring-aspects	< 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	–	org.springframework:spring-webflux	>= 5.3.31, < 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5
TuxCare:Maven	–	org.springframework:spring-webmvc	>= 5.3.31, < 5.3.31-tuxcare.5 Fix: upgrade to 5.3.31-tuxcare.5

Original advisory text

TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 2 org.springframework packages to address 1 CVE. Fixed in 5.3.31-tuxcare.5.

Timeline

Published4 Aug 2026

Updated30 Oct 2026

First seen13 Aug 2026

Sources

CLSA-2026-1782781168 · OSV

Track software like this

Free during beta