Spring Framework 6.1.x Release Notes

Security Fixes

• Control characters in form field names or filenames can no longer split an HTTP response through ContentDisposition when the connector does not reject them (low severity, CVE-2026-59314).
• Malformed WebSocket handshake headers no longer cause HandshakeWebSocketService to include all request headers, including sensitive values, in an exception reason (low severity, CVE-2026-47893).
• Line separators in Server-Sent Event field values can no longer inject additional fields through SseServerResponse and corrupt the event stream (low severity, CVE-2026-59313).
• A self-populating List can no longer bypass the auto-grow collection limit configured on AbstractNestablePropertyAccessor during attacker-controlled property-path traversal (medium severity, CVE-2026-59282).
• Unescaped rejected values and messages are no longer exposed to views by the EscapedErrors no-argument field error accessors (medium severity, CVE-2026-59281).
• Asynchronous XML parsing in Jaxb2XmlDecoder no longer retains aggregated events beyond the configured maxInMemorySize limit (medium severity, CVE-2026-47891).
• Malformed SETUP metadata no longer leaves a retained ConnectionSetupPayload buffer unreleased in MessagingRSocket (medium severity, CVE-2026-47888).
• Attacker-controlled exponents can no longer drive OperatorPower to create unbounded BigDecimal or BigInteger results and exhaust CPU or heap (medium severity, CVE-2026-47886).
  • A BigDecimal or BigInteger power operation in a SpEL expression whose estimated result exceeds 1,000,000 bits — roughly a 300,000-digit decimal number — now throws a SpelEvaluationException instead of computing the result. Applications that legitimately perform large power arithmetic can raise or remove this limit by setting the spring.expression.maxBigPowerBits JVM system property (or the equivalent Spring property), or by passing a custom maximumBigPowerBits value to the SpelParserConfiguration constructor — use Integer.MAX_VALUE for no limit.
• A configured maxPartSize is now enforced by PartEventHttpMessageReader even when maxInMemorySize is unlimited (medium severity, CVE-2026-47885).
• A CORS preflight request can no longer invoke a route handler matched against the would-be actual request in RouterFunctionWebHandler when using toHttpHandler without DispatcherHandler (medium severity, CVE-2026-47892).
• Globally enabled SpEL compilation no longer bypasses the restrictions SimpleEvaluationContext enforces during interpreted evaluation (medium severity, CVE-2026-59283).
  • SpEL expression compilation is now disabled by default for SimpleEvaluationContext. Applications that relied on spring.expression.compiler.mode or SpelParserConfiguration to compile expressions evaluated in a SimpleEvaluationContext will now fall back to interpreted evaluation, and can opt back in with the new SimpleEvaluationContext.Builder.withCompilationSupported() method. An already-compiled expression is ignored — not cleared — when evaluated through a context that does not support compilation.
  • EvaluationContext also gains a new isCompilationSupported() default method, which an implementation may override to declare that expressions evaluated within it may not be compiled. Existing EvaluationContext implementations are unaffected and continue to support compilation.
• Template names containing backslashes can no longer escape the configured template directory through SpringTemplateLoader.findTemplateSource() (medium severity, CVE-2026-59280).
• A request-derived view name that still begins with redirect: or forward: once the configured prefix and suffix are applied is now rejected with a 400 Bad Request by UrlFilenameViewController instead of triggering navigation (medium severity, CVE-2026-47887).
• An untrusted view URL can no longer select an arbitrary stylesheet resource location through XsltView.getStylesheetSource() (critical severity, CVE-2026-47884).

Security Fixes

• Multipart request smuggling in Spring MVC and WebFlux (CVE-2026-41853).

Security Fixes

• Predictable WebSocket session ID generation in spring-websocket (CVE-2026-41838).
• Session fixation race in WebFlux InMemoryWebSession (CVE-2026-41839).
• Memory leak in WebFlux multipart PartGenerator enabling denial of service (CVE-2026-41840).
• Cache collisions in CachingResourceResolver could expose protected static resources (CVE-2026-41841).
• Denial of service via slow versioned static resource resolution (CVE-2026-41842).
• Path traversal in versioned static resource resolution (CVE-2026-41843).
• Open redirect via redirect: and forward: prefixes in default view name translation (CVE-2026-41844).
• Incorrect escaping in JavaScriptUtils#javaScriptEscape enabling cross-site scripting (CVE-2026-41845).
• Cross-site scripting via unescaped cssClass, cssErrorClass, and cssStyle attributes in JSP form tags (CVE-2026-41846).
• Regular expression denial of service (ReDoS) in AntPathMatcher (CVE-2026-41848).
• Algorithmic denial of service in Spring Expression Language (SpEL); adds a configurable maximum-operations limit (CVE-2026-41850).
• Unbounded SpEL pattern cache growth leading to memory exhaustion (CVE-2026-41851).
• SpEL permitted zero-argument method invocation in restricted evaluation contexts (CVE-2026-41852).
• Arbitrary class instantiation in the JMS MappingJackson2MessageConverter; adds a trusted-packages API to restrict deserialization (CVE-2026-41855).

Security Fixes

• DoS with Multipart Temp Files in WebFlux (CVE-2026-22740)
• Static resource cache poisoning in Spring MVC and WebFlux (CVE-2026-22741)
• Denial of service in static resource handling on Windows platforms (CVE-2026-22745)

Security Fixes

• SSE content spoofing via unvalidated id and event field values in SseEmitter and ServerSentEvent (CVE-2026-22735).
• Path traversal via unvalidated template location in ScriptTemplateView (CVE-2026-22737).

Security Fixes

• This patches the Spring Framework STOMP over websocket CSRF vulnerability (CVE-2025-41254).

Security Fixes

• This patches the Spring Framework annotation detection vulnerability (CVE-2025-41249).

Security Fixes

• Fixed a "Path Traversal Vulnerability" occurring in Spring web MVC applications deployed to a Servlet container that is not secured.
  • This addresses CVE-2025-41242.

Dependency Upgrades

• Aspectj 1.9.24
• AssertJ 3.27.4