Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Spring Framework libraries may let attackers run code
published 2 months ago
Summary
Several Spring Framework components—including spring-instrument, spring-expression, spring-core, spring-jms, and spring-context-support—had security weaknesses that could allow a malicious user to execute code on your servers. TuxCare has rebuilt these packages and released a safe version called 5.3.29-tuxcare.9. Apply this update as soon as possible to protect your applications.
What to do
- Update springframework org.springframework:spring-instrument to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-expression to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-core to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-jms to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-context-support to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-orm to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-beans to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-aspects to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-tx to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-oxm to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-context to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-jdbc to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-messaging to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-context-indexer to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-jcl to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-r2dbc to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-webmvc to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-web to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-websocket to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-webflux to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-aop to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-test to version 5.3.29-tuxcare.9.
- Update springframework org.springframework:spring-framework-bom to version 5.3.29-tuxcare.9.
- Update org.springframework:spring-context to version 5.3.29-tuxcare.9.
- Update org.springframework:spring-context-support to version 5.3.29-tuxcare.9.
- Update org.springframework:spring-expression to version 5.3.29-tuxcare.9.
- Update org.springframework:spring-jms to version 5.3.29-tuxcare.9.
- Update org.springframework:spring-messaging to version 5.3.29-tuxcare.9.
- Update org.springframework:spring-webflux to version 5.3.29-tuxcare.9.
- Update org.springframework:spring-webmvc to version 5.3.29-tuxcare.9.
- Update org.springframework:spring-websocket to version 5.3.29-tuxcare.9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | springframework | org.springframework:spring-instrument |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-expression |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-core |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-jms |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-context-support |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-orm |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-beans |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-aspects |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-tx |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-oxm |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-context |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-jdbc |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-messaging |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-context-indexer |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-jcl |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-r2dbc |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-webmvc |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-web |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-websocket |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-webflux |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-aop |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-test |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | springframework | org.springframework:spring-framework-bom |
< 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | – | org.springframework:spring-context |
>= 5.3.29, < 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | – | org.springframework:spring-context-support |
>= 5.3.29, < 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | – | org.springframework:spring-expression |
>= 5.3.29, < 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | – | org.springframework:spring-jms |
>= 5.3.29, < 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | – | org.springframework:spring-messaging |
>= 5.3.29, < 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | – | org.springframework:spring-webflux |
>= 5.3.29, < 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | – | org.springframework:spring-webmvc |
>= 5.3.29, < 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
| TuxCare:Maven | – | org.springframework:spring-websocket |
>= 5.3.29, < 5.3.29-tuxcare.9 Fix: upgrade to 5.3.29-tuxcare.9
|
Original advisory text
TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 6 CVEs. Fixed in 5.3.29-tuxcare.9.
Timeline
Published2 Sep 2026
Updated2 Nov 2026
First seen2 Sep 2026
Sources
CLSA-2026-1788349330 · OSV
Track software like this
Free during beta