Broadcom has released new updates to address 91 Spring Framework vulnerabilities, expanding the scope of fixes across a wide set of Spring-related projects. While many issues are rated medium or low, the release includes one critical vulnerability and a dozen-plus high-severity findings that security teams should treat as urgent.
Spring remains a foundational open source application framework for the Java platform, used to build enterprise systems with capabilities like dependency injection, aspect-oriented programming, and modular support for web, data, and messaging architectures. Because it sits so close to core application logic, weaknesses in the Spring ecosystem can quickly translate into real-world risk for downstream services.
What’s included in the Spring updates
The update set announced by Broadcom patches 91 vulnerabilities in the Spring application development framework. In addition to the overall count, one vulnerability is assigned the top severity rating.
Critical vulnerability: CVE-2026-59270 impacts Spring Security’s embedded UnboundID LDAP server. According to the published details, it could allow an attacker to authenticate and modify entries in the in-memory directory.
Beyond that single critical issue, the release also covers more than a dozen high-severity vulnerabilities. These high-risk flaws can be used in multiple attack patterns, including cross-site scripting (XSS), information disclosure, remote code execution (RCE), denial of service (DoS), security bypasses, and unauthorized access.
The remaining vulnerabilities are rated medium and low severity, but they still matter—especially in environments where even “lower” issues can be chained with other weaknesses or exposed to untrusted inputs.
Which Spring projects are affected
Patch impact is not limited to the core Spring framework alone. Sonatype analyzed the changes and reported that they affect more than 200,000 software components. That wide reach comes from how many applications reuse the Spring modules and related libraries across dependency trees.
Among the projects called out as impacted are: Spring Security, Spring AI, Cloud Config, Data REST, Integration, Reactor Core, Reactor Netty, AMQP, and Batch. If your application relies on any of these components directly—or indirectly through transitive dependencies—your patch review should include the new updates.
Two additional noteworthy vulnerabilities
Sonatype also highlighted two specific issues from within the patch set:
- CVE-2026-59285: described as a critical remote code execution issue in Spring for GraphQL.
- CVE-2026-59318: rated medium severity in Spring AI’s tool-calling functionality, where the published analysis indicates it could enable privilege escalation through prompt injection.
These examples show how the ecosystem risk extends beyond traditional web-layer issues. In particular, AI-adjacent functionality introduces scenarios where input handling and control-flow assumptions become security-critical.
Why the number of Spring issues is rising
Security teams tracking vulnerability trends may recognize the pattern: this year has already seen a surge in Spring-related patches. Sonatype reported that more than 200 vulnerabilities have been patched so far this year, compared with 16 patched in 2025 and 22 in 2024.
The source attributes this rise, in part, to the increased use of AI in the development process. While the direct engineering details are not the focus here, the practical takeaway is clear: organizations using Spring should assume that patch cadence can increase and plan for rapid response.
It’s also important to remember that open source vulnerabilities don’t remain hypothetical. Spring flaws have been exploited in the wild, including the well-known Spring4Shell. As a result, delays in patching can turn a newly fixed issue into a window of opportunity for attackers.
Real-world threat relevance: exploited in the wild
Spring vulnerabilities are more than academic. The ecosystem includes vulnerabilities that have seen real exploitation, and the broader risk landscape is supported by public guidance. The source notes that the CISA KEV catalog currently includes several such vulnerabilities.
When a vulnerability maps to common exploitation goals—like code execution, authentication bypass, or data exposure—it becomes attractive for threat actors. The high-severity categories mentioned in this update set (XSS, information disclosure, RCE, DoS, and unauthorized access) align closely with common pathways to compromise.
Even if your application is not directly exposed to the internet, exploitation can still occur through internal services, misconfigured network access, or endpoints accessible through API gateways and reverse proxies.
What you should do next
If your software uses Spring or any of the related modules affected by this release, you should treat the update as a priority security task. Open source project guidance is consistent: review the latest Spring patches and apply them to your environments.
1) Inventory your Spring dependencies
Start with a dependency inventory for both your direct and transitive libraries. Look specifically for Spring Framework and the modules identified in the update impact list, such as Spring Security and components from the Reactor or Netty families.
Because the Sonatype analysis suggests impact across a very large number of components, it’s common for applications to pull in Spring libraries indirectly through other frameworks and internal packages.
2) Prioritize by reachable risk
Not every vulnerability will have equal relevance in your setup. For example, CVE-2026-59270 is linked to Spring Security’s embedded LDAP server, so it matters most if your deployment uses that embedded LDAP component and if attackers can reach the relevant attack surface.
Similarly, CVE-2026-59285 stands out for RCE potential in Spring for GraphQL, so prioritize exposure paths that include GraphQL endpoints and input-handling logic.
For medium issues like CVE-2026-59318, focus on whether you run Spring AI tool-calling features and how user-controlled prompts are processed.
3) Patch promptly and validate
After upgrading to the patched versions, run validation tests that cover authentication flows, API endpoints, and any areas tied to the vulnerable components. Also check for configuration changes introduced by upgrades, since security fixes can interact with defaults.
If you maintain multiple environments, roll out patches in a structured way—starting with staging to confirm compatibility and then moving to production on a tight schedule.
Broader context: patching under active exploitation
Spring4Shell demonstrated that even widely used frameworks can contain high-impact weaknesses that attackers actively pursue. With additional issues being patched now—plus clear examples of RCE and security bypass categories—this release should be viewed through the lens of real attacker incentives.
Organizations that already run regular vulnerability management workflows will still benefit from tightening response times for Spring ecosystem updates, especially when severity includes critical and high ratings and when public catalogs highlight known exploited vulnerabilities.
Conclusion
Broadcom’s release of updates addressing 91 Spring Framework vulnerabilities is a strong signal that security teams using the Spring ecosystem should act quickly. With one critical issue (CVE-2026-59270) and multiple high-severity flaws ranging from XSS and information disclosure to RCE and DoS, the risk spans both traditional application security and newer AI-adjacent functionality.
Use Sonatype’s impact findings to guide your dependency review, prioritize the components most relevant to your exposure, and apply the latest patches to reduce the chance that known weaknesses can be exploited before upgrades land.
Source: https://www.securityweek.com/91-vulnerabilities-patched-in-spring-application-framework/
