Do Son New updates address multiple Spring framework security vulnerabilities, resolving a critical authentication bypass threat and several denial of service bugs.
Spring Framework
New Spring Boot flaws (CVSS 9.1) bypass security filters and enable RCE via timing attacks. Impacting versions 2.7.x to 4.0.x—secure your Java apps now.
Critical RCE and XSS vulnerabilities hit Apache ActiveMQ (CVE-2026-41044, 40466). Authenticated attackers can hijack the JVM. Update to 5.19.6 or 6.2.5 now.
CISA adds CVE-2026-34197 to KEV. Apache ActiveMQ's Jolokia bridge flaw allows RCE via remote Spring XML loading. Remediate by April 30, 2026. Patch now!
Apache ActiveMQ patches a critical 2026 RCE flaw. Learn how CVE-2026-34197 uses Jolokia and Spring XML to hijack the JVM. Update to 5.19.5 or 6.2.3 now!
Spring Cloud Config faces a high-severity CVSS 8.6 flaw (CVE-2026-22739). Attackers can manipulate profiles to access local files or launch SSRF attacks.
Researchers found two flaws in Spring Framework (CVE-2026-22737 & CVE-2026-22735) allowing path bypasses and stream corruption. Patch your apps today.
Spring fixed two flaws: CVE-2025-41253 allows SpEL injection in Cloud Gateway to expose secrets, and CVE-2025-41254 allows STOMP CSRF to send unauthorized WebSocket messages. Update immediately.
Two medium-severity flaws in Spring Security and the Spring Framework allow authorization bypasses in applications that use method-level security on generic types.
A medium-severity flaw (CVE-2025-41234) in Spring Framework allows Reflected File Download (RFD) attacks. Update to 6.2.8, 6.1.21, or 6.0.29 immediately
A critical Spring Cloud Gateway flaw allows header spoofing from untrusted proxies. Update to fix or disable forwarding.
A Spring Framework vulnerability can allow unauthorized access! Learn how it bypasses security annotations and how to fix it.
Discover the critical vulnerability in the Spring Framework and the impact of CVE-2024-38819 PoC exploit on server security.
Discover the potential security risks posed by CVE-2024-38819, a path traversal vulnerability in Spring Framework, and what it means for web app security
Stay informed about the serious security vulnerability (CVE-2024-38816) in the Spring Framework. Learn how it can potentially affect millions of Java applications worldwide.
CVE-2024-22262 in the widely-used Spring Framework software could leave countless applications vulnerable to redirect and SSRF attacks
CVE-2024-22233 (CVSS 7.5) allows an attacker to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition
The CVE-2023-20862 vulnerability arises when the logout support does not properly clean the security context if using serialized sessions.
Recently, a high-severity vulnerability, CVE-2023-20863, was discovered that may expose Java applications to denial-of-service (DoS) attacks.
The CVE-2023-20860 vulnerability, which carries a Common Vulnerability Scoring System (CVSS) score of 8.8, involves a security bypass