Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Spring Framework modules may let attackers execute code
published 2 months ago
Summary
Several core modules of the Spring Framework – including spring-instrument, spring-expression, spring-core, spring-beans, and spring-aspects – had weaknesses that could allow an attacker to run unauthorized code on your server. The TuxCare update rebuilds these packages with the fixes applied. Install the updated version (6.2.19-tuxcare.1) as soon as possible to protect your applications.
What to do
- Update springframework org.springframework:spring-instrument to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-expression to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-core to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-beans to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-aspects to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-context to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-framework-bom to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-context-indexer to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-core-test to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:framework-docs to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-test to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-jms to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-web to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-orm to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-oxm to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-jdbc to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-websocket to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-messaging to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-webflux to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-jcl to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-r2dbc to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-aop to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-webmvc to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-context-support to version 6.2.19-tuxcare.1.
- Update springframework org.springframework:spring-tx to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-aop to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-beans to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-context to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-context-support to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-expression to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-jdbc to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-jms to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-messaging to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-orm to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-oxm to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-r2dbc to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-tx to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-web to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-webflux to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-webmvc to version 6.2.19-tuxcare.1.
- Update org.springframework:spring-websocket to version 6.2.19-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | springframework | org.springframework:spring-instrument |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-expression |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-core |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-beans |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-aspects |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-context |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-framework-bom |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-context-indexer |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-core-test |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:framework-docs |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-test |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-jms |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-web |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-orm |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-oxm |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-jdbc |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-websocket |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-messaging |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-webflux |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-jcl |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-r2dbc |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-aop |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-webmvc |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-context-support |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | springframework | org.springframework:spring-tx |
< 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-aop |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-beans |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-context |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-context-support |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-expression |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-jdbc |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-jms |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-messaging |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-orm |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-oxm |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-r2dbc |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-tx |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-web |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-webflux |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-webmvc |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
| TuxCare:Maven | – | org.springframework:spring-websocket |
>= 6.2.19, < 6.2.19-tuxcare.1 Fix: upgrade to 6.2.19-tuxcare.1
|
Original advisory text
TuxCare security update for org.springframework (17 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 17 CVEs. Fixed in 6.2.19-tuxcare.1.
Timeline
Published31 Aug 2026
Updated2 Nov 2026
First seen1 Sep 2026
Sources
CLSA-2026-1788201541 · OSV
Track software like this
Free during beta