Vulnerability GHSA-cjpg-rgq5-fr37
Medium Risk
MEDIUM RISK
CVSS Score: 5.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 months ago
June 09, 2026 at 06:31 AM UTC
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8
Summary
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
Details
Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
Spring Framework Cross-site Scripting via JSP Form Tags
1.0.0 - 1.0.1 GHSA-957g-f97v-vppc
1.0.0 - 1.0.1 GHSA-957g-f97v-vppc
Medium Risk
3 months ago
Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40 GHSA-vqgp-pf68-6947
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40 GHSA-vqgp-pf68-6947
High Risk
3 months ago
Spring Framework Cross-site Scripting via JavaScriptUtils
1.0.0 - 1.0.1 GHSA-3chg-m5w7-qfv5
1.0.0 - 1.0.1 GHSA-3chg-m5w7-qfv5
Medium Risk
3 months ago
Spring Framework Escalation via Session Fixation in WebFlux
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8 GHSA-4hfh-6x8g-gwpp
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8 GHSA-4hfh-6x8g-gwpp
Medium Risk
3 months ago
Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8 GHSA-72pg-x5f8-j25j
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8 GHSA-72pg-x5f8-j25j
Impacted packages
Timeline
Published
3 months ago
June 09, 2026 at 06:31 AM UTC
Fixed (7.0.8)
Unknown
Unknown
Fixed (6.2.19)
Unknown
Unknown
Fixed (7.0.8)
Unknown
Unknown
Fixed (6.2.19)
Unknown
Unknown
Last Modified
18 days ago
September 10, 2026 at 03:51 AM UTC