🚨 91 New Spring CVEs Just Hit 209,000+ Software Components
On August 20, 2026, Broadcom released one of the largest coordinated vulnerability disclosures the Java ecosystem has seen in years. Sonatype tracked 91 CVEs across the Spring Framework and its satellite projects, impacting an estimated 209,569 software components — and the number was still climbing at publication.
Affected Projects
Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch. Flaw types include insecure deserialization, untrusted code execution, information disclosure, SSRF, path traversal, denial-of-service, and broken authorization.
The Two CVEs to Watch
🔴 CVE-2026-59285 — 9.2 CRITICAL unsafe deserialization flaw in Spring for GraphQL. Exploitable when an app uses Jackson 2.x deserialization, exposes paginated GraphQL fields, and has reachable dangerous classes — can lead to remote code execution.
🤖 CVE-2026-59318 — Prompt-injection flaw in Spring AI's tool-calling functionality. Can trigger unauthorized tool invocation and privilege escalation. A preview of a new vulnerability class at the intersection of AI agents and traditional software security.
The Real Problem: Transitive Dependencies
Most of the 209,569 affected components don't import Spring directly — it's buried two or three layers deep through internal SDKs and logging wrappers. A patched upstream release doesn't protect you until maintainers adopt it, your team rebuilds, and your pipeline redeploys.
Detection Commands
mvn dependency:tree | grep -i spring
./gradlew dependencies --configuration compileClasspath | grep -i spring
syft dir:. -o cyclonedx-json > sbom.json
grype sbom:./sbom.json
The Bigger Trend
AI-assisted vulnerability research is surfacing new affected components 46x faster than pre-AI rates, and Spring security advisories rose 1,700%+ month-over-month earlier this year. This is the new normal for supply chain security, not a one-off event.
Full breakdown with the complete CVE list, prevention checklist, and SOC remediation strategy:
👉 https://www.xpert4cyber.com/2026/08/91-spring-vulnerabilities-cve-2026.html
Top comments (0)