Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Spring Web libraries could let attackers exploit applications

published 2 days ago
Summary

Four parts of the Spring Framework—spring-web, spring-webflux, spring-webmvc, and spring-websocket—were found to have security weaknesses that could allow a malicious user to gain unauthorized access or disrupt service. TuxCare has released updated versions (6.2.14‑tuxcare.3) that fix these problems. Apply the update promptly to keep your Java‑based applications safe.

What to do
  • Update springframework org.springframework:spring-web to version 6.2.14-tuxcare.3.
  • Update springframework org.springframework:spring-webflux to version 6.2.14-tuxcare.3.
  • Update springframework org.springframework:spring-webmvc to version 6.2.14-tuxcare.3.
  • Update springframework org.springframework:spring-websocket to version 6.2.14-tuxcare.3.
Affected software
Ecosystem VendorProductAffected versions
TuxCare:Maven springframework org.springframework:spring-web >= 6.2.14, < 6.2.14-tuxcare.3
Fix: upgrade to 6.2.14-tuxcare.3
TuxCare:Maven springframework org.springframework:spring-webflux >= 6.2.14, < 6.2.14-tuxcare.3
Fix: upgrade to 6.2.14-tuxcare.3
TuxCare:Maven springframework org.springframework:spring-webmvc >= 6.2.14, < 6.2.14-tuxcare.3
Fix: upgrade to 6.2.14-tuxcare.3
TuxCare:Maven springframework org.springframework:spring-websocket >= 6.2.14, < 6.2.14-tuxcare.3
Fix: upgrade to 6.2.14-tuxcare.3
Original advisory text
TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 3 CVEs. Fixed in 6.2.14-tuxcare.3.
Timeline
Published2 Nov 2026
Updated2 Nov 2026
First seen2 Nov 2026
Sources
CLSA-2026-1793618191 · OSV
Track software like this
Free during beta