{"url":"http://public2.vulnerablecode.io/api/packages/33369?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@5.3.39","type":"maven","namespace":"org.springframework","name":"spring-webmvc","version":"5.3.39","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"6.0.14","latest_non_vulnerable_version":"7.0.7","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37207?format=json","vulnerability_id":"VCID-2zmy-n763-wqde","summary":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n\nSpecifically, an application is vulnerable when both of the following are true:\n\n  *  the web application uses RouterFunctions to serve static resources\n  *  resource handling is explicitly configured with a FileSystemResource location\n\n\nHowever, malicious requests are blocked and rejected when any of the following is true:\n\n  *  the  Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use\n  *  the application runs on Tomcat or Jetty","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38816.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38816.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38816","reference_id":"","reference_type":"","scores":[{"value":"0.9389","scoring_system":"epss","scoring_elements":"0.99884","published_at":"2026-06-12T12:55:00Z"},{"value":"0.9389","scoring_system":"epss","scoring_elements":"0.99883","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38816"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38816","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38816"},{"reference_url":"https://github.com/spring-projects/spring-framework","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/spring-projects/spring-framework"},{"reference_url":"https://github.com/spring-projects/spring-framework/commit/d86bf8b2056429edf5494456cffcb2b243331c49","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/spring-projects/spring-framework/commit/d86bf8b2056429edf5494456cffcb2b243331c49"},{"reference_url":"https://security.netapp.com/advisory/ntap-20241227-0001","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20241227-0001"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2312060","reference_id":"2312060","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2312060"},{"reference_url":"https://spring.io/security/cve-2024-38816","reference_id":"cve-2024-38816","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-13T13:40:55Z/"}],"url":"https://spring.io/security/cve-2024-38816"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38816","reference_id":"CVE-2024-38816","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38816"},{"reference_url":"https://github.com/advisories/GHSA-cx7f-g6mp-7hqm","reference_id":"GHSA-cx7f-g6mp-7hqm","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cx7f-g6mp-7hqm"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:11023","reference_id":"RHSA-2024:11023","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:11023"},{"reference_url":"https://access.redhat.com/errata/RHSA-2024:8064","reference_id":"RHSA-2024:8064","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2024:8064"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33365?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@6.1.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3jte-3bxv-5bfh"},{"vulnerability":"VCID-j84u-4qkp-r7g8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@6.1.13"}],"aliases":["CVE-2024-38816","GHSA-cx7f-g6mp-7hqm"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2zmy-n763-wqde"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/83558?format=json","vulnerability_id":"VCID-3jte-3bxv-5bfh","summary":"Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.\n\n\nMore precisely, an application can be vulnerable when all the following are true:\n\n  *  the application is using Spring MVC or Spring WebFlux\n  *  the application is serving static resources from the file system\n  *  the application is running on a Windows platform\n\n\nWhen all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22745.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22745.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22745","reference_id":"","reference_type":"","scores":[{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.21032","published_at":"2026-06-12T12:55:00Z"},{"value":"0.00067","scoring_system":"epss","scoring_elements":"0.20856","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22745"},{"reference_url":"https://github.com/spring-projects/spring-framework","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/spring-projects/spring-framework"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22745","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22745"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463790","reference_id":"2463790","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463790"},{"reference_url":"https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L&version=3.1","reference_id":"A:L&version=3.1","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-29T13:23:48Z/"}],"url":"https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L&version=3.1"},{"reference_url":"https://spring.io/security/cve-2026-22745","reference_id":"cve-2026-22745","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-29T13:23:48Z/"}],"url":"https://spring.io/security/cve-2026-22745"},{"reference_url":"https://github.com/advisories/GHSA-6p4f-wcwh-5vvm","reference_id":"GHSA-6p4f-wcwh-5vvm","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6p4f-wcwh-5vvm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33362?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@6.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2zmy-n763-wqde"},{"vulnerability":"VCID-b4s5-d4c6-33ev"},{"vulnerability":"VCID-hccj-t215-gbdw"},{"vulnerability":"VCID-xsn6-fbp3-uyf9"},{"vulnerability":"VCID-zv17-28rz-uqhb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@6.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/373951?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@6.2.18","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@6.2.18"},{"url":"http://public2.vulnerablecode.io/api/packages/373950?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@7.0.7","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@7.0.7"}],"aliases":["CVE-2026-22745","GHSA-6p4f-wcwh-5vvm"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3jte-3bxv-5bfh"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/83479?format=json","vulnerability_id":"VCID-j84u-4qkp-r7g8","summary":"Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.\n\n\nMore precisely, an application can be vulnerable when all the following are true:\n\n  *  the application is using Spring MVC or Spring WebFlux\n  *  the application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabled\n  *  the application adds support for encoded resources resolution\n  *  the resource cache must be empty when the attacker has access to the application\n\n\nWhen all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22741.json","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22741.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22741","reference_id":"","reference_type":"","scores":[{"value":"0.00083","scoring_system":"epss","scoring_elements":"0.24211","published_at":"2026-06-11T12:55:00Z"},{"value":"0.00083","scoring_system":"epss","scoring_elements":"0.24407","published_at":"2026-06-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22741"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22741","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22741"},{"reference_url":"https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title"},{"reference_url":"https://github.com/spring-projects/spring-framework","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/spring-projects/spring-framework"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22741","reference_id":"","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22741"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463788","reference_id":"2463788","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463788"},{"reference_url":"https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L&version=3.1","reference_id":"A:L&version=3.1","reference_type":"","scores":[{"value":"3.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-29T13:19:19Z/"}],"url":"https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L&version=3.1"},{"reference_url":"https://spring.io/security/cve-2026-22741","reference_id":"cve-2026-22741","reference_type":"","scores":[{"value":"0.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N"},{"value":"3.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-29T13:19:19Z/"}],"url":"https://spring.io/security/cve-2026-22741"},{"reference_url":"https://github.com/advisories/GHSA-wg35-8jpf-2xv3","reference_id":"GHSA-wg35-8jpf-2xv3","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wg35-8jpf-2xv3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33362?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@6.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2zmy-n763-wqde"},{"vulnerability":"VCID-b4s5-d4c6-33ev"},{"vulnerability":"VCID-hccj-t215-gbdw"},{"vulnerability":"VCID-xsn6-fbp3-uyf9"},{"vulnerability":"VCID-zv17-28rz-uqhb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@6.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/373951?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@6.2.18","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@6.2.18"},{"url":"http://public2.vulnerablecode.io/api/packages/373950?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@7.0.7","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@7.0.7"}],"aliases":["CVE-2026-22741","GHSA-wg35-8jpf-2xv3"],"risk_score":2.6,"exploitability":"0.5","weighted_severity":"5.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-j84u-4qkp-r7g8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37187?format=json","vulnerability_id":"VCID-r3ny-1vc6-83g6","summary":"Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38828.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38828.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38828","reference_id":"","reference_type":"","scores":[{"value":"0.00076","scoring_system":"epss","scoring_elements":"0.23058","published_at":"2026-06-12T12:55:00Z"},{"value":"0.00076","scoring_system":"epss","scoring_elements":"0.22861","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-38828"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38828","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38828"},{"reference_url":"https://github.com/spring-projects/spring-framework","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/spring-projects/spring-framework"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38828","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38828"},{"reference_url":"https://security.netapp.com/advisory/ntap-20250509-0009","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20250509-0009"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326889","reference_id":"2326889","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326889"},{"reference_url":"https://spring.io/security/cve-2024-38828","reference_id":"cve-2024-38828","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-18T15:07:55Z/"}],"url":"https://spring.io/security/cve-2024-38828"},{"reference_url":"https://github.com/advisories/GHSA-w3c8-7r8f-9jp8","reference_id":"GHSA-w3c8-7r8f-9jp8","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-w3c8-7r8f-9jp8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/372819?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@5.3.42","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@5.3.42"},{"url":"http://public2.vulnerablecode.io/api/packages/33362?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@6.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2zmy-n763-wqde"},{"vulnerability":"VCID-b4s5-d4c6-33ev"},{"vulnerability":"VCID-hccj-t215-gbdw"},{"vulnerability":"VCID-xsn6-fbp3-uyf9"},{"vulnerability":"VCID-zv17-28rz-uqhb"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@6.0.0"}],"aliases":["CVE-2024-38828","GHSA-w3c8-7r8f-9jp8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-r3ny-1vc6-83g6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/83347?format=json","vulnerability_id":"VCID-xsn6-fbp3-uyf9","summary":"Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22737.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22737.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22737","reference_id":"","reference_type":"","scores":[{"value":"0.00096","scoring_system":"epss","scoring_elements":"0.26737","published_at":"2026-06-12T12:55:00Z"},{"value":"0.00096","scoring_system":"epss","scoring_elements":"0.26535","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22737"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22737","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22737"},{"reference_url":"https://github.com/spring-projects/spring-framework","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/spring-projects/spring-framework"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22737","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22737"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449348","reference_id":"2449348","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449348"},{"reference_url":"https://spring.io/security/cve-2026-22737","reference_id":"cve-2026-22737","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-20T14:43:36Z/"}],"url":"https://spring.io/security/cve-2026-22737"},{"reference_url":"https://github.com/advisories/GHSA-4773-3jfm-qmx3","reference_id":"GHSA-4773-3jfm-qmx3","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-4773-3jfm-qmx3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/375252?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@6.2.17","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3jte-3bxv-5bfh"},{"vulnerability":"VCID-j84u-4qkp-r7g8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@6.2.17"},{"url":"http://public2.vulnerablecode.io/api/packages/375251?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@7.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3jte-3bxv-5bfh"},{"vulnerability":"VCID-j84u-4qkp-r7g8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@7.0.6"}],"aliases":["CVE-2026-22737","GHSA-4773-3jfm-qmx3"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-xsn6-fbp3-uyf9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/83566?format=json","vulnerability_id":"VCID-zv17-28rz-uqhb","summary":"Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22735.json","reference_id":"","reference_type":"","scores":[{"value":"2.6","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22735.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22735","reference_id":"","reference_type":"","scores":[{"value":"0.00092","scoring_system":"epss","scoring_elements":"0.26041","published_at":"2026-06-12T12:55:00Z"},{"value":"0.00092","scoring_system":"epss","scoring_elements":"0.25841","published_at":"2026-06-11T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-22735"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22735","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22735"},{"reference_url":"https://github.com/spring-projects/spring-framework","reference_id":"","reference_type":"","scores":[{"value":"2.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/spring-projects/spring-framework"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22735","reference_id":"","reference_type":"","scores":[{"value":"2.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22735"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449347","reference_id":"2449347","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449347"},{"reference_url":"https://spring.io/security/cve-2026-22735","reference_id":"cve-2026-22735","reference_type":"","scores":[{"value":"2.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N"},{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-20T14:44:28Z/"}],"url":"https://spring.io/security/cve-2026-22735"},{"reference_url":"https://github.com/advisories/GHSA-6hcq-hmm3-jj3c","reference_id":"GHSA-6hcq-hmm3-jj3c","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6hcq-hmm3-jj3c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/375252?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@6.2.17","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3jte-3bxv-5bfh"},{"vulnerability":"VCID-j84u-4qkp-r7g8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@6.2.17"},{"url":"http://public2.vulnerablecode.io/api/packages/375251?format=json","purl":"pkg:maven/org.springframework/spring-webmvc@7.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-3jte-3bxv-5bfh"},{"vulnerability":"VCID-j84u-4qkp-r7g8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@7.0.6"}],"aliases":["CVE-2026-22735","GHSA-6hcq-hmm3-jj3c"],"risk_score":1.4,"exploitability":"0.5","weighted_severity":"2.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zv17-28rz-uqhb"}],"fixing_vulnerabilities":[],"risk_score":"10.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework/spring-webmvc@5.3.39"}