Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:deb/debian/libspring-java@4.2.7-1?distro=trixie
Typedeb
Namespacedebian
Namelibspring-java
Version4.2.7-1
Qualifiers
distro trixie
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version4.3.2-1
Latest_non_vulnerable_version4.3.30-4
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-kpma-e8rd-b7c8
vulnerability_id VCID-kpma-e8rd-b7c8
summary 
Pivotal Spring Framework contains unsafe Java deserialization methods
Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.

Maintainers recommend investigating alternative components or a potential mitigating control. Version 4.2.6 and 3.2.17 contain [enhanced documentation](https://github.com/spring-projects/spring-framework/commit/5cbe90b2cd91b866a5a9586e460f311860e11cfa) advising users to take precautions against unsafe Java deserialization, version 5.3.0 [deprecate the impacted classes](https://github.com/spring-projects/spring-framework/issues/25379) and version 6.0.0 [removed it entirely](https://github.com/spring-projects/spring-framework/issues/27422).
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-1000027.json
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-1000027.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-1000027
reference_id
reference_type
scores
0
value 0.60417
scoring_system epss
scoring_elements 0.98289
published_at 2026-04-18T12:55:00Z
1
value 0.60417
scoring_system epss
scoring_elements 0.98288
published_at 2026-04-16T12:55:00Z
2
value 0.60417
scoring_system epss
scoring_elements 0.98266
published_at 2026-04-01T12:55:00Z
3
value 0.60417
scoring_system epss
scoring_elements 0.98269
published_at 2026-04-02T12:55:00Z
4
value 0.60417
scoring_system epss
scoring_elements 0.98282
published_at 2026-04-13T12:55:00Z
5
value 0.60417
scoring_system epss
scoring_elements 0.98281
published_at 2026-04-11T12:55:00Z
6
value 0.60417
scoring_system epss
scoring_elements 0.98278
published_at 2026-04-09T12:55:00Z
7
value 0.60417
scoring_system epss
scoring_elements 0.98272
published_at 2026-04-07T12:55:00Z
8
value 0.60417
scoring_system epss
scoring_elements 0.98277
published_at 2026-04-08T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-1000027
2
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000027
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000027
4
reference_url https://github.com/spring-projects/spring-framework
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework
5
reference_url https://github.com/spring-projects/spring-framework/commit/2b051b8b321768a4cfef83077db65c6328ffd60f
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/2b051b8b321768a4cfef83077db65c6328ffd60f
6
reference_url https://github.com/spring-projects/spring-framework/commit/5cbe90b2cd91b866a5a9586e460f311860e11cfa
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/commit/5cbe90b2cd91b866a5a9586e460f311860e11cfa
7
reference_url https://github.com/spring-projects/spring-framework/issues/21680
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/issues/21680
8
reference_url https://github.com/spring-projects/spring-framework/issues/24434
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/issues/24434
9
reference_url https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-1231625331
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-1231625331
10
reference_url https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626
11
reference_url https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417
12
reference_url https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525
13
reference_url https://jira.spring.io/browse/SPR-17143?redirect=false
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://jira.spring.io/browse/SPR-17143?redirect=false
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-1000027
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-1000027
15
reference_url https://security.netapp.com/advisory/ntap-20230420-0009
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20230420-0009
16
reference_url https://security.netapp.com/advisory/ntap-20230420-0009/
reference_id
reference_type
scores
url https://security.netapp.com/advisory/ntap-20230420-0009/
17
reference_url https://security-tracker.debian.org/tracker/CVE-2016-1000027
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://security-tracker.debian.org/tracker/CVE-2016-1000027
18
reference_url https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now
19
reference_url https://support.contrastsecurity.com/hc/en-us/articles/4402400830612-Spring-web-Java-Deserialization-CVE-2016-1000027
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://support.contrastsecurity.com/hc/en-us/articles/4402400830612-Spring-web-Java-Deserialization-CVE-2016-1000027
20
reference_url https://www.tenable.com/security/research/tra-2016-20
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.tenable.com/security/research/tra-2016-20
21
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1357929
reference_id 1357929
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1357929
22
reference_url https://github.com/advisories/GHSA-4wrc-f8pq-fpqp
reference_id GHSA-4wrc-f8pq-fpqp
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-4wrc-f8pq-fpqp
fixed_packages
0
url pkg:deb/debian/libspring-java@4.2.7-1?distro=trixie
purl pkg:deb/debian/libspring-java@4.2.7-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/libspring-java@4.2.7-1%3Fdistro=trixie
1
url pkg:deb/debian/libspring-java@4.3.30-1?distro=trixie
purl pkg:deb/debian/libspring-java@4.3.30-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/libspring-java@4.3.30-1%3Fdistro=trixie
2
url pkg:deb/debian/libspring-java@4.3.30-2?distro=trixie
purl pkg:deb/debian/libspring-java@4.3.30-2?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/libspring-java@4.3.30-2%3Fdistro=trixie
3
url pkg:deb/debian/libspring-java@4.3.30-3?distro=trixie
purl pkg:deb/debian/libspring-java@4.3.30-3?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/libspring-java@4.3.30-3%3Fdistro=trixie
4
url pkg:deb/debian/libspring-java@4.3.30-4?distro=trixie
purl pkg:deb/debian/libspring-java@4.3.30-4?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/libspring-java@4.3.30-4%3Fdistro=trixie
aliases CVE-2016-1000027, GHSA-4wrc-f8pq-fpqp
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-kpma-e8rd-b7c8
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:deb/debian/libspring-java@4.2.7-1%3Fdistro=trixie