Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Spring Framework packages could let attackers run code
published 2 months ago
Summary
Five Spring Framework components – spring, spring-aop, spring-aspects, spring-beans and spring-context – have been rebuilt to fix ten security weaknesses. If these weaknesses are left unpatched, a malicious user could cause the affected applications to execute unwanted code or access data they shouldn’t. Update to the TuxCare version 5.3.7-tuxcare.5 as soon as possible to protect your systems.
What to do
- Update springframework org.springframework:spring to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-aop to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-aspects to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-beans to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-context to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-context-indexer to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-context-support to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-core to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-expression to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-framework-bom to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-instrument to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-jcl to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-jdbc to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-jms to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-messaging to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-orm to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-oxm to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-r2dbc to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-test to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-tx to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-web to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-webflux to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-webmvc to version 5.3.7-tuxcare.5.
- Update springframework org.springframework:spring-websocket to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-aop to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-beans to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-context to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-context-support to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-core to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-expression to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-jdbc to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-jms to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-messaging to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-orm to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-oxm to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-r2dbc to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-test to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-tx to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-web to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-webflux to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-webmvc to version 5.3.7-tuxcare.5.
- Update org.springframework:spring-websocket to version 5.3.7-tuxcare.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | springframework | org.springframework:spring |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-aop |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-aspects |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-beans |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-context |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-context-indexer |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-context-support |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-core |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-expression |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-framework-bom |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-instrument |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-jcl |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-jdbc |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-jms |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-messaging |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-orm |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-oxm |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-r2dbc |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-test |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-tx |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-web |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-webflux |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-webmvc |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | springframework | org.springframework:spring-websocket |
< 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-aop |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-beans |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-context |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-context-support |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-core |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-expression |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-jdbc |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-jms |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-messaging |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-orm |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-oxm |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-r2dbc |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-test |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-tx |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-web |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-webflux |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-webmvc |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
| TuxCare:Maven | – | org.springframework:spring-websocket |
>= 5.3.7, < 5.3.7-tuxcare.5 Fix: upgrade to 5.3.7-tuxcare.5
|
Original advisory text
TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 10 CVEs. Fixed in 5.3.7-tuxcare.5.
Timeline
Published12 Aug 2026
Updated2 Nov 2026
First seen15 Oct 2026
Sources
CLSA-2026-1786552823 · OSV
Track software like this
Free during beta