Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Spring Framework packages may let attackers execute code
published 2 months ago
Summary
Three Spring Framework components – web MVC, expression handling, and core utilities – have been updated to fix security weaknesses that could let an attacker run unwanted code on your server. The fix is included in version 4.2.9.RELEASE-tuxcare.8. Apply the updated packages as soon as possible to protect your applications.
What to do
- Update springframework org.springframework:spring-webmvc to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-expression to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-core to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-test to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-jms to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-web to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-context-support to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-orm to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-beans to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-aspects to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-tx to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-oxm to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-context to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-framework-bom to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-messaging to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-instrument-tomcat to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-websocket to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-webmvc-portlet to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-aop to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-instrument to version 4.2.9.RELEASE-tuxcare.8.
- Update springframework org.springframework:spring-jdbc to version 4.2.9.RELEASE-tuxcare.8.
- Update org.springframework:spring-context to version 4.2.9.RELEASE-tuxcare.8.
- Update org.springframework:spring-context-support to version 4.2.9.RELEASE-tuxcare.8.
- Update org.springframework:spring-expression to version 4.2.9.RELEASE-tuxcare.8.
- Update org.springframework:spring-jms to version 4.2.9.RELEASE-tuxcare.8.
- Update org.springframework:spring-messaging to version 4.2.9.RELEASE-tuxcare.8.
- Update org.springframework:spring-web to version 4.2.9.RELEASE-tuxcare.8.
- Update org.springframework:spring-webmvc to version 4.2.9.RELEASE-tuxcare.8.
- Update org.springframework:spring-webmvc-portlet to version 4.2.9.RELEASE-tuxcare.8.
- Update org.springframework:spring-websocket to version 4.2.9.RELEASE-tuxcare.8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | springframework | org.springframework:spring-webmvc |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-expression |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-core |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-test |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-jms |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-web |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-context-support |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-orm |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-beans |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-aspects |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-tx |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-oxm |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-context |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-framework-bom |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-messaging |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-instrument-tomcat |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-websocket |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-webmvc-portlet |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-aop |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-instrument |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | springframework | org.springframework:spring-jdbc |
< 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | – | org.springframework:spring-context |
>= 4.2.9.RELEASE, < 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | – | org.springframework:spring-context-support |
>= 4.2.9.RELEASE, < 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | – | org.springframework:spring-expression |
>= 4.2.9.RELEASE, < 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | – | org.springframework:spring-jms |
>= 4.2.9.RELEASE, < 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | – | org.springframework:spring-messaging |
>= 4.2.9.RELEASE, < 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | – | org.springframework:spring-web |
>= 4.2.9.RELEASE, < 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | – | org.springframework:spring-webmvc |
>= 4.2.9.RELEASE, < 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | – | org.springframework:spring-webmvc-portlet |
>= 4.2.9.RELEASE, < 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
| TuxCare:Maven | – | org.springframework:spring-websocket |
>= 4.2.9.RELEASE, < 4.2.9.RELEASE-tuxcare.8 Fix: upgrade to 4.2.9.RELEASE-tuxcare.8
|
Original advisory text
TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 3 org.springframework packages to address 3 CVEs. Fixed in 4.2.9.RELEASE-tuxcare.8.
Timeline
Published12 Aug 2026
Updated2 Nov 2026
First seen13 Aug 2026
Sources
CLSA-2026-1786573855 · OSV
Track software like this
Free during beta