Loading story…
Spring Framework versions 3.2.0–3.2.8 and 4.0.0–4.0.4 contain a directory-traversal vulnerability, tracked as CVE-2014-3578. Version 3.1.1 was also confirmed vulnerable, and unsupported releases may be affected. A remote attacker could exploit the flaw to access arbitrary files on an affected server.
Organizations using Spring Framework 3.x should upgrade to version 3.2.9 or later, while users of the 4.x branch should upgrade to 4.0.5 or later. Teams running legacy or unsupported releases should assess exposure because affected versions beyond those explicitly confirmed cannot be ruled out.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Users of Spring Framework 3.x were advised to upgrade to 3.2.9 or later, while 4.x users were advised to upgrade to 4.0.5 or later to address the directory traversal vulnerability.
A directory traversal vulnerability affecting Spring Framework 3.2.0–3.2.8 and 4.0.0–4.0.4 was disclosed. A remote attacker could access arbitrary files on vulnerable servers; version 3.1.1 was confirmed affected, and unsupported releases might also be vulnerable.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
VMware Tanzu Spring Cloud Config Server is affected by multiple newly disclosed vulnerabilities, led by **CVE-2026-40982**, a critical `CWE-22` directory traversal flaw that lets unauthenticated attackers use crafted URLs to read arbitrary text and binary files from the host running `spring-cloud-config-server`. Public reporting says the issue affects release lines `3.1.x`, `4.1.x`, `4.2.x`, `4.3.x`, and `5.0.x`, with the most severe impact tied to unauthorized file access from network-reachable servers. Additional flaws include **CVE-2026-40981**, which can expose Google Secrets Manager data from unintended GCP projects, **CVE-2026-41002**, a race condition involving the Git repository clone base directory, and **CVE-2026-41004**, which can leak sensitive information into plaintext logs when trace logging is enabled. Spring has released fixes including `4.3.3` and `5.0.3` for open-source users, while enterprise support customers were directed to `3.1.14`, `4.1.10`, and `4.2.7`; a temporary mitigation for the GCP secret exposure issue is to require token validation before serving project secrets.
Jun 29, 2026
Two critical vulnerabilities in the Spring ecosystem exposed Java applications to remote code execution: **CVE-2022-22965** in the Spring Framework, widely known as **Spring4Shell**, and **CVE-2022-22963** in **Spring Cloud Function**. Spring4Shell abuses the framework’s data-binding mechanism under specific conditions—including **JDK 9+**, **Apache Tomcat**, vulnerable Spring Framework versions, and **WAR** deployment—to let attackers overwrite Tomcat logging configuration and drop a **JSP web shell** on the server. The Spring Cloud Function issue, **CVE-2022-22963**, allows code injection through a crafted `spring.cloud.function.routing-expression` HTTP header that exploits **Spring Expression Language (SpEL)** to achieve remote code execution. Vendor and security reporting identified affected versions, published fixes and mitigations, and highlighted detection opportunities including exploit-related file hashes and generic security verdicts for spotting attempted compromise.
Sep 3, 2026
A high-severity denial-of-service flaw, **CVE-2026-41849**, was disclosed in the Spring Framework **SpEL** evaluation engine, where an integer overflow can let a remote, unauthenticated attacker exhaust resources if a network-exposed application evaluates attacker-controlled expressions. The issue affects **Spring Framework 5.3.0 through 5.3.48** and carries a **CVSS 3.1 score of 7.5**, with impact limited to availability. Spring said the vulnerability applies to the **5.3.x** branch and that newer releases **6.2.19** and **7.0.8** are not affected. Public open-source remediation is available in those newer branches, while the fix for **5.3.x** is **5.3.49** and is available through commercial **Tanzu Spring Enterprise** because the 5.3 line has reached end of life; no public proof-of-concept or confirmed in-the-wild exploitation had been reported at publication time.
Jul 10, 2026