Spring

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 7.4HighMar 20, 2025Spring Security Auth bypass / access controlCVE-2025-22228BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
• 7.5HighSep 13, 2024Spring Path traversal / file handlingCVE-2024-38816Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is15% likelyExploit codeNucleiDetection
• 8.1HighApr 16, 2024Spring Framework SSRFCVE-2024-22262Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is 1.2% likelyExploit code
• 8.1HighMar 16, 2024Spring Framework SSRFCVE-2024-22259Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.2.6% likely
• 8.1HighFeb 23, 2024Spring Framework SSRFCVE-2024-22243Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is 4% likelyExploit code

See every Spring entry on the dashboard.

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• Atlassian · Nov 18, 2025Atlassian Security Bulletin November 18, 2025CVE-2024-22259
• Atlassian · Jul 15, 2025Atlassian Security Bulletin July 15, 2025CVE-2025-22228
• Atlassian · Jun 17, 2025Atlassian Security Bulletin June 17, 2025CVE-2024-38816CVE-2025-22228
• Atlassian · Dec 10, 2024Atlassian Security Bulletin December 10, 2024CVE-2024-38816
• Atlassian · Nov 19, 2024Atlassian Security Bulletin November 19, 2024CVE-2024-38816
• Atlassian · Aug 20, 2024Atlassian Security Bulletin August 20, 2024CVE-2024-22243CVE-2024-22259CVE-2024-22262
• Atlassian · Jul 16, 2024Atlassian Security Bulletin July 16, 2024CVE-2024-22262
• Atlassian · Jun 18, 2024Atlassian Security Bulletin June 18, 2024CVE-2024-22243CVE-2024-22259CVE-2024-22262
• Atlassian · May 21, 2024Atlassian Security Bulletin May 21, 2024CVE-2024-22262
• Atlassian · Apr 16, 2024Atlassian Security Bulletin April 16, 2024CVE-2024-22243CVE-2024-22259