securityweek.comarticle91 Vulnerabilities Patched in Spring Application Framework
SecurityWeek reports on Broadcom's Spring framework patching 91 vulnerabilities in one release, including a critical auth bypass in Spring Security's embedded UnboundID LDAP server (CVE-2026-59270), a critical RCE in Spring for GraphQL (CVE-2026-59285), and a medium-severity prompt-injection privilege escalation in Spring AI's tool-calling functionality (CVE-2026-59318). Sonatype's analysis found the flaws affect over 200,000 software components across projects like Spring Security, Spring Cloud Config, Reactor Netty, and Spring Batch, and notes Spring vulnerability counts have surged in 2026 (200+ so far) versus 16 in 2025 and 22 in 2024, attributed to Broadcom's use of AI in development.
CVEs named here
- CVE-2026-59270
- CVE-2026-59285
- CVE-2026-59318
Technologies named here
- LDAP
- Sonatype
- Spring Security
- CISA KEV catalog
- Spring AI
- Spring Cloud Config
- Spring Data REST
- Spring Integration
- Reactor Core
- Reactor Netty
- Spring AMQP
- Spring Batch
- Spring for GraphQL
- Spring
- GraphQL
- CISA KEV
Techniques named here
- Cross-site scripting
- Information disclosure
- Remote code execution
- Denial of service
- Security bypass
- Unauthorized access
- Privilege escalation through prompt injection
- Authentication and directory entry modification
Threat actors named here
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup