91 Security Flaws Fixed in Spring, the Java Framework Powering Hundreds of Thousands of Apps
One critical flaw lets attackers silently alter user records. Over 200 vulnerabilities have already been patched in Spring this year alone, a sharp rise tied to Broadcom's push into AI.
Key points
- Broadcom released patches fixing 91 vulnerabilities in its Spring Java framework during the last week of June 2025.
- One flaw, CVE-2026-59270, is rated critical and lets an attacker log in and alter user records in Spring Security's built-in directory system.
- Cybersecurity firm Sonatype found the patches touch more than 200,000 software components used across the industry.
- Spring has patched more than 200 vulnerabilities so far in 2025, up from 16 in all of 2024.
- Several older Spring flaws are listed by the US Cybersecurity and Infrastructure Security Agency (CISA) as actively exploited in the real world.
What is Spring, and why should you care?
Spring is a free, open-source toolkit that software developers use to build business applications, the kind that run payroll systems, booking platforms, banking portals, and thousands of other services you interact with every day. It runs on the Java programming language and is one of the most widely used frameworks on the planet.
Broadcom, the chip and software giant that bought VMware in 2024, now maintains Spring. Last week it pushed out a batch of security fixes, as first reported by SecurityWeek.
How bad is the worst flaw?
The single critical-rated vulnerability is CVE-2026-59270. It lives inside Spring Security's embedded UnboundID LDAP server, which is an internal directory used to store and look up user credentials. An attacker who targets this flaw can authenticate without proper authorisation and then quietly edit entries in that directory, think changing account details or access rights.
Cybersecurity firm Sonatype separately flagged CVE-2026-59285 as a critical remote code execution flaw in Spring for GraphQL. Remote code execution means an attacker can run their own commands on a server from anywhere on the internet, without needing physical access.
| CVE | Component | Severity | Impact |
|---|---|---|---|
| CVE-2026-59270 | Spring Security LDAP | Critical | Unauthorised login and record modification |
| CVE-2026-59285 | Spring for GraphQL | Critical | Remote code execution |
| CVE-2026-59318 | Spring AI tool-calling | Medium | Privilege escalation via prompt injection |
| Multiple others | Spring Security, Reactor, AMQP, Batch | High | XSS, data leaks, denial of service, security bypasses |
XSS, or cross-site scripting, is a type of attack where criminals inject malicious code into a web page that then runs inside a victim's browser. Denial of service means crashing a system so it stops responding to legitimate users.
Why is the number of Spring flaws rising so fast?
The numbers are stark. Spring has patched more than 200 vulnerabilities already in 2025. The full-year totals were 16 in 2024 and 22 in 2025. Sonatype attributes the surge directly to Broadcom expanding Spring's AI-related features, more new code means more places for flaws to hide.
Spring vulnerabilities are not theoretical. CISA's Known Exploited Vulnerabilities catalogue includes several Spring flaws that criminals have used in real attacks. The most notorious example is Spring4Shell, a 2022 flaw that attackers exploited widely.
What should developers do right now?
If your organisation builds or maintains software that uses any Spring component, check whether your version is affected. Apply Broadcom's latest patches as quickly as your testing cycle allows. Sonatype's analysis found more than 200,000 software components are touched by these updates, so the exposure is broad.
If you are an end user of a service rather than a developer, there is no direct action needed on your part. Keep an eye on security notices from the apps and platforms you rely on, and update promptly when prompted.
