Spring Framework Release Notes

Security Fixes

• Control characters in form field names or filenames can no longer split an HTTP response through ContentDisposition when the connector does not reject them (low severity, CVE-2026-59314).
• Malformed WebSocket handshake headers no longer cause HandshakeWebSocketService to include all request headers, including sensitive values, in an exception reason (low severity, CVE-2026-47893).
• Line separators in Server-Sent Event field values can no longer inject additional fields through SseServerResponse and corrupt the event stream (low severity, CVE-2026-59313).
• Bare carriage returns in view fragments rendered by ViewResolutionResultHandler and ResponseBodyEmitterReturnValueHandler can no longer terminate an SSE field and corrupt the event stream (low severity, CVE-2026-47890).
• A self-populating List can no longer bypass the auto-grow collection limit configured on AbstractNestablePropertyAccessor during attacker-controlled property-path traversal (medium severity, CVE-2026-59282).
• Unescaped rejected values and messages are no longer exposed to views by the EscapedErrors no-argument field error accessors (medium severity, CVE-2026-59281).
• Asynchronous XML parsing in Jaxb2XmlDecoder no longer retains aggregated events beyond the configured maxInMemorySize limit (medium severity, CVE-2026-47891).
• Configured SameSite cookie attributes are no longer omitted from Jetty Core responses written by JettyCoreServerHttpResponse (medium severity, CVE-2026-47889).
• Malformed SETUP metadata no longer leaves a retained ConnectionSetupPayload buffer unreleased in MessagingRSocket (medium severity, CVE-2026-47888).
• Attacker-controlled exponents can no longer drive OperatorPower to create unbounded BigDecimal or BigInteger results and exhaust CPU or heap (medium severity, CVE-2026-47886).
  • A BigDecimal or BigInteger power operation in a SpEL expression whose estimated result exceeds 1,000,000 bits — roughly a 300,000-digit decimal number — now throws a SpelEvaluationException instead of computing the result. Applications that legitimately perform large power arithmetic can raise or remove this limit by setting the spring.expression.maxBigPowerBits JVM system property (or the equivalent Spring property), or by passing a custom maximumBigPowerBits value to the SpelParserConfiguration constructor — use Integer.MAX_VALUE for no limit.
• A configured maxPartSize is now enforced by PartEventHttpMessageReader even when maxInMemorySize is unlimited (medium severity, CVE-2026-47885).
• A CORS preflight request can no longer invoke a route handler matched against the would-be actual request in RouterFunctionWebHandler when using toHttpHandler without DispatcherHandler (medium severity, CVE-2026-47892).
• Globally enabled SpEL compilation no longer bypasses the restrictions SimpleEvaluationContext enforces during interpreted evaluation (medium severity, CVE-2026-59283).
  • SpEL expression compilation is now disabled by default for SimpleEvaluationContext. Applications that relied on spring.expression.compiler.mode or SpelParserConfiguration to compile expressions evaluated in a SimpleEvaluationContext will now fall back to interpreted evaluation, and can opt back in with the new SimpleEvaluationContext.Builder.withCompilationSupported() method. An already-compiled expression is ignored — not cleared — when evaluated through a context that does not support compilation.
  • EvaluationContext also gains a new isCompilationSupported() default method, which an implementation may override to declare that expressions evaluated within it may not be compiled. Existing EvaluationContext implementations are unaffected and continue to support compilation.
• Template names containing backslashes can no longer escape the configured template directory through SpringTemplateLoader.findTemplateSource() (medium severity, CVE-2026-59280).
• A request-derived view name that still begins with redirect: or forward: once the configured prefix and suffix are applied is now rejected with a 400 Bad Request by UrlFilenameViewController instead of triggering navigation (medium severity, CVE-2026-47887).
• A request path beginning with two slashes no longer produces a protocol-relative redirect to an attacker-controlled host in UrlHandlerFilter (medium severity, CVE-2026-47883).
• An untrusted view URL can no longer select an arbitrary stylesheet resource location through XsltView.getStylesheetSource() (critical severity, CVE-2026-47884).

Security Fixes

• Control characters in form field names or filenames can no longer split an HTTP response through ContentDisposition when the connector does not reject them (low severity, CVE-2026-59314).
• Malformed WebSocket handshake headers no longer cause HandshakeWebSocketService to include all request headers, including sensitive values, in an exception reason (low severity, CVE-2026-47893).
• Line separators in Server-Sent Event field values can no longer inject additional fields through SseServerResponse and corrupt the event stream (low severity, CVE-2026-59313).
• A self-populating List can no longer bypass the auto-grow collection limit configured on AbstractNestablePropertyAccessor during attacker-controlled property-path traversal (medium severity, CVE-2026-59282).
• Unescaped rejected values and messages are no longer exposed to views by the EscapedErrors no-argument field error accessors (medium severity, CVE-2026-59281).
• Asynchronous XML parsing in Jaxb2XmlDecoder no longer retains aggregated events beyond the configured maxInMemorySize limit (medium severity, CVE-2026-47891).
• Malformed SETUP metadata no longer leaves a retained ConnectionSetupPayload buffer unreleased in MessagingRSocket (medium severity, CVE-2026-47888).
• Attacker-controlled exponents can no longer drive OperatorPower to create unbounded BigDecimal or BigInteger results and exhaust CPU or heap (medium severity, CVE-2026-47886).
  • A BigDecimal or BigInteger power operation in a SpEL expression whose estimated result exceeds 1,000,000 bits — roughly a 300,000-digit decimal number — now throws a SpelEvaluationException instead of computing the result. Applications that legitimately perform large power arithmetic can raise or remove this limit by setting the spring.expression.maxBigPowerBits JVM system property (or the equivalent Spring property), or by passing a custom maximumBigPowerBits value to the SpelParserConfiguration constructor — use Integer.MAX_VALUE for no limit.
• A configured maxPartSize is now enforced by PartEventHttpMessageReader even when maxInMemorySize is unlimited (medium severity, CVE-2026-47885).
• A CORS preflight request can no longer invoke a route handler matched against the would-be actual request in RouterFunctionWebHandler when using toHttpHandler without DispatcherHandler (medium severity, CVE-2026-47892).
• Globally enabled SpEL compilation no longer bypasses the restrictions SimpleEvaluationContext enforces during interpreted evaluation (medium severity, CVE-2026-59283).
  • SpEL expression compilation is now disabled by default for SimpleEvaluationContext. Applications that relied on spring.expression.compiler.mode or SpelParserConfiguration to compile expressions evaluated in a SimpleEvaluationContext will now fall back to interpreted evaluation, and can opt back in with the new SimpleEvaluationContext.Builder.withCompilationSupported() method. An already-compiled expression is ignored — not cleared — when evaluated through a context that does not support compilation.
  • EvaluationContext also gains a new isCompilationSupported() default method, which an implementation may override to declare that expressions evaluated within it may not be compiled. Existing EvaluationContext implementations are unaffected and continue to support compilation.
• Template names containing backslashes can no longer escape the configured template directory through SpringTemplateLoader.findTemplateSource() (medium severity, CVE-2026-59280).
• A request-derived view name that still begins with redirect: or forward: once the configured prefix and suffix are applied is now rejected with a 400 Bad Request by UrlFilenameViewController instead of triggering navigation (medium severity, CVE-2026-47887).
• An untrusted view URL can no longer select an arbitrary stylesheet resource location through XsltView.getStylesheetSource() (critical severity, CVE-2026-47884).

Security Fixes

• Control characters in form field names or filenames can no longer split an HTTP response through ContentDisposition when the connector does not reject them (low severity, CVE-2026-59314).
• Malformed WebSocket handshake headers no longer cause HandshakeWebSocketService to include all request headers, including sensitive values, in an exception reason (low severity, CVE-2026-47893).
• Line separators in Server-Sent Event field values can no longer inject additional fields through SseServerResponse and corrupt the event stream (low severity, CVE-2026-59313).
• A self-populating List can no longer bypass the auto-grow collection limit configured on AbstractNestablePropertyAccessor during attacker-controlled property-path traversal (medium severity, CVE-2026-59282).
• Unescaped rejected values and messages are no longer exposed to views by the EscapedErrors no-argument field error accessors (medium severity, CVE-2026-59281).
• Asynchronous XML parsing in Jaxb2XmlDecoder no longer retains aggregated events beyond the configured maxInMemorySize limit (medium severity, CVE-2026-47891).
• Malformed SETUP metadata no longer leaves a retained ConnectionSetupPayload buffer unreleased in MessagingRSocket (medium severity, CVE-2026-47888).
• Attacker-controlled exponents can no longer drive OperatorPower to create unbounded BigDecimal or BigInteger results and exhaust CPU or heap (medium severity, CVE-2026-47886).
  • A BigDecimal or BigInteger power operation in a SpEL expression whose estimated result exceeds 1,000,000 bits — roughly a 300,000-digit decimal number — now throws a SpelEvaluationException instead of computing the result. Applications that legitimately perform large power arithmetic can raise or remove this limit by setting the spring.expression.maxBigPowerBits JVM system property (or the equivalent Spring property), or by passing a custom maximumBigPowerBits value to the SpelParserConfiguration constructor — use Integer.MAX_VALUE for no limit.
• A CORS preflight request can no longer invoke a route handler matched against the would-be actual request in RouterFunctionWebHandler when using toHttpHandler without DispatcherHandler (medium severity, CVE-2026-47892).
• Globally enabled SpEL compilation no longer bypasses the restrictions SimpleEvaluationContext enforces during interpreted evaluation (medium severity, CVE-2026-59283).
  • SpEL expression compilation is now disabled by default for SimpleEvaluationContext. Applications that relied on spring.expression.compiler.mode or SpelParserConfiguration to compile expressions evaluated in a SimpleEvaluationContext will now fall back to interpreted evaluation, and can opt back in with the new SimpleEvaluationContext.Builder.withCompilationSupported() method. An already-compiled expression is ignored — not cleared — when evaluated through a context that does not support compilation.
  • EvaluationContext also gains a new isCompilationSupported() default method, which an implementation may override to declare that expressions evaluated within it may not be compiled. Existing EvaluationContext implementations are unaffected and continue to support compilation.
• Template names containing backslashes can no longer escape the configured template directory through SpringTemplateLoader.findTemplateSource() (medium severity, CVE-2026-59280).
• A request-derived view name that still begins with redirect: or forward: once the configured prefix and suffix are applied is now rejected with a 400 Bad Request by UrlFilenameViewController instead of triggering navigation (medium severity, CVE-2026-47887).
• An untrusted view URL can no longer select an arbitrary stylesheet resource location through XsltView.getStylesheetSource() (critical severity, CVE-2026-47884).

Security Fixes

• Control characters in a multipart form field name or filename are no longer written unfiltered into the Content-Disposition header by HttpHeaders.setContentDispositionFormData, so a CR or LF can no longer corrupt the message framing (low severity, CVE-2026-59314).
• A self-populating List can no longer bypass the auto-grow collection limit configured on AbstractNestablePropertyAccessor during attacker-controlled property-path traversal (medium severity, CVE-2026-59282).
• Unescaped rejected values and messages are no longer exposed to views by the EscapedErrors no-argument field error accessors (medium severity, CVE-2026-59281).
• Attacker-controlled exponents can no longer drive OperatorPower to create unbounded BigDecimal or BigInteger results and exhaust CPU or heap (medium severity, CVE-2026-47886).
  • A BigDecimal or BigInteger power operation in a SpEL expression whose estimated result exceeds 1,000,000 bits — roughly a 300,000-digit decimal number — now throws a SpelEvaluationException instead of computing the result. Applications that legitimately perform large power arithmetic can raise or remove this limit by setting the spring.expression.maxBigPowerBits JVM system property (or the equivalent Spring property), or by passing a custom maximumBigPowerBits value to the SpelParserConfiguration constructor — use Integer.MAX_VALUE for no limit.
• Globally enabled SpEL compilation no longer bypasses the restrictions SimpleEvaluationContext enforces during interpreted evaluation (medium severity, CVE-2026-59283).
  • SpEL expression compilation is now disabled by default for SimpleEvaluationContext. Applications that relied on spring.expression.compiler.mode or SpelParserConfiguration to compile expressions evaluated in a SimpleEvaluationContext will now fall back to interpreted evaluation, and can opt back in with the new SimpleEvaluationContext.Builder.withCompilationSupported() method. An already-compiled expression is ignored — not cleared — when evaluated through a context that does not support compilation.
  • This line also gains a new public interface, org.springframework.expression.CompilationAwareEvaluationContext, which an EvaluationContext implementation may implement to declare whether expressions evaluated within it may be compiled. Upstream expresses this as a default method on EvaluationContext itself, which is not possible on this line because its sources compile at Java 6 source level. Existing EvaluationContext implementations are unaffected and continue to support compilation.
• Template names containing backslashes can no longer escape the configured template directory through SpringTemplateLoader.findTemplateSource() (medium severity, CVE-2026-59280).
• A request-derived view name that still begins with redirect: or forward: once the configured prefix and suffix are applied is now rejected with a 400 Bad Request by UrlFilenameViewController instead of triggering navigation (medium severity, CVE-2026-47887).
• An untrusted view URL can no longer select an arbitrary stylesheet resource location through XsltView.getStylesheetSource() (critical severity, CVE-2026-47884).

Security Fixes

• Multipart request smuggling in Spring MVC and WebFlux (CVE-2026-41853).

Security Fixes

• Multipart request smuggling in Spring MVC and WebFlux (CVE-2026-41853).

Security Fixes

• Predictable WebSocket session ID generation in spring-websocket (CVE-2026-41838).
• Session fixation race in WebFlux InMemoryWebSession (CVE-2026-41839).
• Memory leak in WebFlux multipart PartGenerator enabling denial of service (CVE-2026-41840).
• Cache collisions in CachingResourceResolver could expose protected static resources (CVE-2026-41841).
• Denial of service via slow versioned static resource resolution (CVE-2026-41842).
• Path traversal in versioned static resource resolution (CVE-2026-41843).
• Open redirect via redirect: and forward: prefixes in default view name translation (CVE-2026-41844).
• Incorrect escaping in JavaScriptUtils#javaScriptEscape enabling cross-site scripting (CVE-2026-41845).
• Cross-site scripting via unescaped cssClass, cssErrorClass, and cssStyle attributes in JSP form tags (CVE-2026-41846).
• Regular expression denial of service (ReDoS) in AntPathMatcher (CVE-2026-41848).
• Algorithmic denial of service in Spring Expression Language (SpEL); adds a configurable maximum-operations limit (CVE-2026-41850).
• Unbounded SpEL pattern cache growth leading to memory exhaustion (CVE-2026-41851).
• SpEL permitted zero-argument method invocation in restricted evaluation contexts (CVE-2026-41852).
• Arbitrary class instantiation in the JMS MappingJackson2MessageConverter; adds a trusted-packages API to restrict deserialization (CVE-2026-41855).

Security Fixes

• Predictable WebSocket session ID generation in spring-websocket (CVE-2026-41838).
• Session fixation race in WebFlux InMemoryWebSession (CVE-2026-41839).
• Memory leak in WebFlux multipart PartGenerator enabling denial of service (CVE-2026-41840).
• Cache collisions in CachingResourceResolver could expose protected static resources (CVE-2026-41841).
• Denial of service via slow versioned static resource resolution (CVE-2026-41842).
• Path traversal in versioned static resource resolution (CVE-2026-41843).
• Open redirect via redirect: and forward: prefixes in default view name translation (CVE-2026-41844).
• Incorrect escaping in JavaScriptUtils#javaScriptEscape enabling cross-site scripting (CVE-2026-41845).
• Cross-site scripting via unescaped cssClass, cssErrorClass, and cssStyle attributes in JSP form tags (CVE-2026-41846).
• WebFlux Kotlin Router DSL discarded filter modifications to ServerRequest, bypassing security filters (CVE-2026-41847).
• Regular expression denial of service (ReDoS) in AntPathMatcher (CVE-2026-41848).
• Integer overflow in Spring Expression Language (SpEL) evaluation enabling denial of service (CVE-2026-41849).
• Algorithmic denial of service in SpEL; adds a configurable maximum-operations limit (CVE-2026-41850).
• Unbounded SpEL pattern cache growth leading to memory exhaustion (CVE-2026-41851).
• SpEL permitted zero-argument method invocation in restricted evaluation contexts (CVE-2026-41852).
• Arbitrary class instantiation in the JMS MappingJackson2MessageConverter; adds a trusted-packages API to restrict deserialization (CVE-2026-41855).

Security Fixes

• Cache collisions in CachingResourceResolver could expose protected static resources (CVE-2026-41841).
• Denial of service via slow versioned static resource resolution (CVE-2026-41842).
• Path traversal in versioned static resource resolution (CVE-2026-41843).
• Open redirect via redirect: and forward: prefixes in default view name translation (CVE-2026-41844).
• Incorrect escaping in JavaScriptUtils#javaScriptEscape enabling cross-site scripting (CVE-2026-41845).
• Cross-site scripting via unescaped cssClass, cssErrorClass, and cssStyle attributes in JSP form tags (CVE-2026-41846).
• Regular expression denial of service (ReDoS) in AntPathMatcher (CVE-2026-41848).
• Integer overflow in Spring Expression Language (SpEL) evaluation enabling denial of service (CVE-2026-41849).
• Algorithmic denial of service in SpEL; adds a configurable maximum-operations limit (CVE-2026-41850).
• Unbounded SpEL pattern cache growth leading to memory exhaustion (CVE-2026-41851).
• SpEL permitted zero-argument method invocation in restricted evaluation contexts (CVE-2026-41852).
• Arbitrary class instantiation in the JMS MappingJackson2MessageConverter; adds a trusted-packages API to restrict deserialization (CVE-2026-41855).

Security Fixes

• DoS with Multipart Temp Files in WebFlux (CVE-2026-22740)
• Static resource cache poisoning in Spring MVC and WebFlux (CVE-2026-22741)
• Denial of service in static resource handling on Windows platforms (CVE-2026-22745)

Security Fixes

• DoS with Multipart Temp Files in WebFlux (CVE-2026-22740)
• Static resource cache poisoning in Spring MVC and WebFlux (CVE-2026-22741)
• Denial of service in static resource handling on Windows platforms (CVE-2026-22745)

Security Fixes

• Static resource cache poisoning in Spring MVC (CVE-2026-22741)
• Denial of service in static resource handling on Windows platforms (CVE-2026-22745)

Security Fixes

• SSE content spoofing via unvalidated id and event field values in SseEmitter and ServerSentEvent (CVE-2026-22735).
• Path traversal via unvalidated template location in ScriptTemplateView (CVE-2026-22737).

Security Fixes

• SSE content spoofing via unvalidated id and event field values in SseEmitter and ServerSentEvent (CVE-2026-22735).
• Path traversal via unvalidated template location in ScriptTemplateView (CVE-2026-22737).

Security Fixes

• SSE content spoofing via unvalidated id and event field values in SseEmitter (CVE-2026-22735).
• Path traversal via unvalidated template location in ScriptTemplateView (CVE-2026-22737).

Security Fixes

• This patches the Spring Framework STOMP over websocket CSRF vulnerability (CVE-2025-41254).

Security Fixes

• This patches the Spring Framework STOMP over websocket CSRF vulnerability (CVE-2025-41254).

Security Fixes

• This patches the Spring Framework STOMP over websocket CSRF vulnerability (CVE-2025-41254).

Security Fixes

• This patches the Spring Framework annotation detection vulnerability (CVE-2025-41249).

Security Fixes

• This patches the Spring Framework annotation detection vulnerability (CVE-2025-41249).

Security Fixes

• Fixed a "Path Traversal Vulnerability" occurring in Spring web MVC applications deployed to a Servlet container that is not secured.
  • This addresses CVE-2025-41242.

Dependency Upgrades

• Aspectj 1.9.24
• AssertJ 3.27.4

Security Fixes

• Fixed a "Path Traversal Vulnerability" occurring in Spring web MVC applications deployed to a Servlet container that is not secured.
  • This addresses CVE-2025-41242.
• Added a no-remoting variant of the spring-web artifact to remove HTTP Invoker remoting support.
  • This addresses CVE-2016-1000027.
  • See the documentation for more information on using the no-remoting variant.

Security Fixes

• Fixed a "Path Traversal Vulnerability" occurring in Spring web MVC applications deployed to a Servlet container that is not secured.
  • This addresses CVE-2025-41242.

Security Fixes

• Fixed an additional vulnerability with DataBinder's disallowedFields related to case insensitivity.
  • This addresses CVE-2025-22233.

Security Fixes

• Fixed an additional vulnerability with DataBinder's disallowedFields related to case insensitivity.
  • This addresses CVE-2025-22233.

Security Fixes

• This release patches the following:
  • Spring Expression DoS Vulnerability (CVE-2022-22950).
    • com.herodevs.nes.springframework:spring-expression:4.3.30-spring-framework-4.3.32
  • Spring Framework RCE via Data Binding on JDK 9+ (CVE-2022-22965).
    • com.herodevs.nes.springframework:spring-beans:4.3.30-spring-framework-4.3.32
    • com.herodevs.nes.springframework:spring-webmvc:4.3.30-spring-framework-4.3.32
  • Spring Framework DoS via Data Binding to MultipartFile or Servlet Part (CVE-2022-22970).
    • com.herodevs.nes.springframework:spring-beans:4.3.30-spring-framework-4.3.32
  • Spring Framework DoS with STOMP over WebSocket (CVE-2022-22971).
    • com.herodevs.nes.springframework:spring-messaging:4.3.30-spring-framework-4.3.32
  • Spring Expression DoS Vulnerability (CVE-2023-20861).
    • com.herodevs.nes.springframework:spring-expression:4.3.30-spring-framework-4.3.32
  • Spring Expression DoS Vulnerability (CVE-2023-20863).
    • com.herodevs.nes.springframework:spring-expression:4.3.30-spring-framework-4.3.32
  • Spring Framework URL Parsing with Host Validation (CVE-2024-22243).
    • com.herodevs.nes.springframework:spring-web:4.3.30-spring-framework-4.3.32
  • Spring Framework URL Parsing with Host Validation (CVE-2024-22259).
    • com.herodevs.nes.springframework:spring-web:4.3.30-spring-framework-4.3.32
  • Spring Framework URL Parsing with Host Validation (CVE-2024-22262).
    • com.herodevs.nes.springframework:spring-web:4.3.30-spring-framework-4.3.32
  • Improper handling of case sensitivity (CVE-2022-22968).
    • com.herodevs.nes.springframework:spring-context:4.3.30-spring-framework-4.3.32
    • com.herodevs.nes.springframework:spring-webmvc:4.3.30-spring-framework-4.3.32
  • Spring Expression DoS Vulnerability (CVE-2024-38808).
    • com.herodevs.nes.springframework:spring-expression:4.3.30-spring-framework-4.3.32
  • Spring Framework DoS via conditional HTTP request (CVE-2024-38809).
    • com.herodevs.nes.springframework:spring-web:4.3.30-spring-framework-4.3.32
  • Spring Framework DataBinder Case Sensitive Match Exception (CVE-2024-38820).
    • com.herodevs.nes.springframework:spring-context:4.3.30-spring-framework-4.3.32
  • DoS via Spring MVC controller method with byte parameter (CVE-2024-38828).
    • com.herodevs.nes.springframework:spring-web:4.3.30-spring-framework-4.3.32
  • Pivotal Spring Framework contains unsafe Java deserialization methods (CVE-2016-1000027).
    • com.herodevs.nes.springframework:spring-web:4.3.30-spring-framework-4.3.32

Security Fixes

• Fixes to core and web packages to address DoS issue.
  • This patches DoS via Spring MVC controller method with byte parameter (CVE-2024-38828).
  • This fix is included in NES for Spring Framework version 5.3.39-spring-framework-5.3.44 in the following artifacts:
    • com.herodevs.nes.springframework:spring-core:5.3.39-spring-framework-5.3.44
    • com.herodevs.nes.springframework:spring-web:5.3.39-spring-framework-5.3.44

Security Fixes

• Fixes to resource handling for Spring's WebMVC.fn and WebFlux.fn (functional) endpoints.
  • This patches a variation of the path traversal vulnerability in Spring's functional web frameworks (CVE-2024-38819).
  • This fix is included in NES for Spring Framework version 5.3.39-spring-framework-5.3.43 in the following artifacts:
    • com.herodevs.nes.springframework:spring-webmvc:5.3.39-spring-framework-5.3.43
    • com.herodevs.nes.springframework:spring-webflux:5.3.39-spring-framework-5.3.43

Security Fixes

• Fixed an issue with DataBinder's disallowedFields related to case insensitivity.
  • This update addresses the Spring Framework DataBinder Case Sensitive Match Exception (CVE-2024-38820).
  • This fix is included in NES for Spring Framework version 5.3.39-spring-framework-5.3.42 in the following artifacts:
    • com.herodevs.nes.springframework:spring-context:5.3.39-spring-framework-5.3.42
    • com.herodevs.nes.springframework:spring-core:5.3.39-spring-framework-5.3.42
    • com.herodevs.nes.springframework:spring-web:5.3.39-spring-framework-5.3.42
    • com.herodevs.nes.springframework:spring-webmvc:5.3.39-spring-framework-5.3.42
    • com.herodevs.nes.springframework:spring-webflux:5.3.39-spring-framework-5.3.42
    • com.herodevs.nes.springframework:spring-websocket:5.3.39-spring-framework-5.3.42

Security Fixes

• Fixes to resource handling for Spring's WebMVC.fn and WebFlux.fn (functional) endpoints.
  • This patches the path traversal vulnerability in Spring's functional web frameworks (CVE-2024-38816).
  • This fix is included in NES for Spring Framework version 5.3.39-spring-framework-5.3.41 in the following artifacts:
    • com.herodevs.nes.springframework:spring-webmvc:5.3.39-spring-framework-5.3.41
    • com.herodevs.nes.springframework:spring-webflux:5.3.39-spring-framework-5.3.41