Search for packages
| purl | pkg:maven/org.springframework/spring-core@3.0-alpha0 |
| Tags | Ghost |
| Next non-vulnerable version | 5.2.24.RELEASE |
| Latest non-vulnerable version | 6.2.11 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-7gb3-6gxd-73f2
Aliases: CVE-2009-1190 GHSA-wjjr-h4wh-w6vv |
Regular expression denial of service (ReDOS) Algorithmic complexity vulnerability in this package allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups, a related issue to CVE-2004-2540. |
Affected by 16 other vulnerabilities. Affected by 16 other vulnerabilities. |
|
VCID-dv5y-1z97-ayhs
Aliases: CVE-2010-1622 GHSA-vpr3-f594-mg5g |
Remote classloader modification This package allows remote attackers to execute arbitrary code via an HTTP request containing `class.classLoader.URLs[0]=jar:` followed by a URL of a crafted `.jar` file. |
Affected by 15 other vulnerabilities. |
|
VCID-h4ys-unzb-cbhn
Aliases: CVE-2011-2730 GHSA-wv88-pf73-x22p |
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection." |
Affected by 0 other vulnerabilities. Affected by 13 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T12:46:47.658842+00:00 | GitLab Importer | Affected by | VCID-h4ys-unzb-cbhn | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-core/CVE-2011-2730.yml | 38.0.0 |
| 2026-04-01T12:46:45.866262+00:00 | GitLab Importer | Affected by | VCID-dv5y-1z97-ayhs | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-core/CVE-2010-1622.yml | 38.0.0 |
| 2026-04-01T12:46:45.618802+00:00 | GitLab Importer | Affected by | VCID-7gb3-6gxd-73f2 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-core/CVE-2009-1190.yml | 38.0.0 |