漏洞公告

BuddyPress: Any authenticated attacker can enumerate another user's complete friend list via IDOR

BuddyPress: Authenticated attackers can access arbitrary private message threads via user_id request parameter

Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

Spring Data REST potentially exposes persistence-layer internals to HTTP clients

Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization

Spring Data REST has Improper Access Control in its JSON Patch Implementation

Spring Data Commons: Denial of Service via excessive memory allocation in projection binding

Spring for Apache Kafka: Improper Validation of Retry Topic Header Values Leads to Retry Sequence Manipulation

Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache

Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads

Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean

Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue

Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)

Spring Data MongoDB Has Regex Parameter Binding Injection in @Query Repository Methods

Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys

Spring Data Relational: Attackers can supply wildcard characters to perform boolean-based blind data inference

Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection