Broad Spring Advisory Wave Exposes 91 CVEs Across Framework and Related Projects

Broadcom published a large set of Spring security advisories affecting Spring Framework and related projects, with Sonatype tracking 91 CVEs and identifying 209,569 affected software components at the time of publication. The disclosures span multiple vulnerability classes, including insecure deserialization, untrusted code execution under certain conditions, sensitive information exposure, SSRF, path traversal, denial of service, and improper authorization, creating a significant downstream remediation burden for organizations that embed vulnerable Spring components indirectly through other software.

Among the most serious issues, CVE-2026-59285 in Spring for GraphQL was highlighted as a critical unsafe deserialization flaw that can lead to remote code execution in specific scenarios, while CVE-2026-59318 in Spring AI was described as a prompt-injection-related tool-calling boundary bypass that could enable privilege escalation. Spring’s security advisory portal published the vendor notices, and defenders were urged to inventory Spring versions across their environments, determine real exposure and exploitability, and move affected systems to fixed releases as quickly as possible.