漏洞公告

Spring Framework Algorithmic Denial of Service via SpEL Expressions

Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux

Spring Framework Arbitrary Method Invocation in SpEL Expressions

Spring Framework Cross-site Scripting via JSP Form Tags

Spring Framework Server-Side Request Forgery via UriComponentsBuilder

Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

Spring Framework Denial of Service via AntPathMatcher

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Spring Framework Predictable Session ID in WebSocket Module

Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

Spring LDAP has Authentication Bypass with Empty Password

Spring Framework Open Redirect in Spring MVC and WebFlux

Spring Framework Denial of Service via Multipart Requests in WebFlux

Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux

Spring Framework Escalation via Session Fixation in WebFlux

Spring HATEOAS heap exhaustion through unbounded internal caching

Spring Framework Cross-site Scripting via JavaScriptUtils

Spring Retry has Cache Exhaustion in Stateful Retries that leads to Denial of Service

Micrometer gRPC server instrumentation DoS

Micrometer HTTP server instrumentations DoS

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections