Skip to content
COOEY

FAIL › dossier

Spring Framework

PRODUCT

· dossier confidence 20%

Spring Framework is a widely used Java application framework that has suffered from high-severity remote code execution vulnerabilities in data binding and JMS components, highlighting critical gaps in input validation and untrusted environment handling.

Failure events
4
Zero-days
0
RCEs
1
On KEV
1
Critical
2
Worst shame
78
PROFILE
Categorysoftware frameworkWhat they doSpring Framework is a Java-based application framework for building enterprise applications. Websitehttps://spring.io ↗
SECURITY POSTURE

The framework has experienced high-severity remote code execution vulnerabilities in data binding and JMS components, indicating gaps in input validation and untrusted environment handling.

Notable failures
  • CVE-2022-22965 RCE via data binding
  • CVE-2026-41855 JMS untrusted environment vulnerability
Patterns: unpatched edge-device RCEs; insufficient input validation in data binding; vulnerabilities in untrusted JMS environments
FAILURE HISTORY · 4
DATEEVENTSEVSUMMARY
2022-04-04 CVE-2022-22965 high VMware Spring Framework apps on JDK 9+ suffered remote code execution via data binding.
2026-06-09 CVE-2026-41855 high CVE-2026-41855: In an untrusted JMS environment, org.springframework.jms.support.converter.Mappi
2020-01-02 CVE-2016-1000027 critical CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code exe
2018-04-06 CVE-2018-1270 critical CVE-2018-1270: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 a
DOSSIER SOURCES
Open questions: What is the exact founding year of Spring Framework? · What is the precise headquarters location of Spring Framework? · What is the exact size of the Spring Framework development team?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-08-30 04:13:18.430649+00:00