Spring Framework Updates Patch 91 Vulnerabilities
Summary
Spring updates patch 91 vulnerabilities. Sonatype says the patches affect over 200,000 software components and highlights issues including a Spring for GraphQL RCE and a Spring AI prompt-injection privilege escalation.
Key points
- Spring developers released updates addressing 91 vulnerabilities; one is rated critical and more than a dozen are rated high severity.
- CVE-2026-59270 affects Spring Security’s embedded UnboundID LDAP server and could allow authentication and modification of entries in its in-memory directory.
- Sonatype says the patches affect more than 200,000 software components across projects including Spring Security, Spring AI, and Reactor Core.
- Sonatype describes CVE-2026-59285 as a critical remote code execution issue in Spring for GraphQL.
- Sonatype says CVE-2026-59318, a medium-severity Spring AI issue, could allow privilege escalation through prompt injection.
- The article says more than 200 Spring vulnerabilities have been patched this year, compared with 16 in 2025 and 22 in 2024, and advises projects to review and apply the latest patches.
Article Details
- Event Type
- Spring framework vulnerability patch release
- Impact
- Updates patch 91 vulnerabilities, including one critical issue affecting Spring Security's embedded UnboundID LDAP server that could allow authentication and modification of in-memory directory entries. Sonatype reported that the flaws affect more than 200,000 software components. Reported vulnerability impacts include remote code execution, XSS, information disclosure, denial of service, security bypasses, unauthorized access, and privilege escalation.
CVE
CVE-2026-59270Vmware · Spring securityA single vulnerability has been assigned a critical severity rating: CVE-2026-59270.CVE-2026-59285Vmware · Spring for graphqlSonatype has highlighted two vulnerabilities: CVE-2026-59285, which it describes as a critical remote code execution issue in Spring for GraphQL, and CVE-2026-59318, a medium-severity issue in Spring AI’s tool-callingCVE-2026-59318Vmware · Spring aiwhich it describes as a critical remote code execution issue in Spring for GraphQL, and CVE-2026-59318, a medium-severity issue in Spring AI’s tool-calling functionality that can allow privilege
Vendors
Products
AMQPsuch as Spring Security, Spring AI, Cloud Config, Data REST, Integration, Reactor Core, Reactor Netty, AMQP, and Batch.BatchSpring Security, Spring AI, Cloud Config, Data REST, Integration, Reactor Core, Reactor Netty, AMQP, and Batch.Cloud Config200,000 software components. The security flaws affect projects such as Spring Security, Spring AI, Cloud Config, Data REST, Integration, Reactor Core, Reactor Netty, AMQP, and Batch.Data RESTcomponents. The security flaws affect projects such as Spring Security, Spring AI, Cloud Config, Data REST, Integration, Reactor Core, Reactor Netty, AMQP, and Batch.IntegrationThe security flaws affect projects such as Spring Security, Spring AI, Cloud Config, Data REST, Integration, Reactor Core, Reactor Netty, AMQP, and Batch.Reactor Coreflaws affect projects such as Spring Security, Spring AI, Cloud Config, Data REST, Integration, Reactor Core, Reactor Netty, AMQP, and Batch.Reactor Nettyprojects such as Spring Security, Spring AI, Cloud Config, Data REST, Integration, Reactor Core, Reactor Netty, AMQP, and Batch.Spring AImore than 200,000 software components. The security flaws affect projects such as Spring Security, Spring AI, Cloud Config, Data REST, Integration, Reactor Core, Reactor Netty, AMQP, and Batch.Spring for GraphQLvulnerabilities: CVE-2026-59285, which it describes as a critical remote code execution issue in Spring for GraphQL, and CVE-2026-59318, a medium-severity issue in Spring AI’s tool-calling functionality that canSpring FrameworkThe developers of Broadcom’s Spring application development framework last week announced the release of updates that patch 91 vulnerabilities.Spring SecurityIt affects Spring Security’s embedded UnboundID LDAP server and could allow an attacker to authenticate and modify entries in the in-memory directory.