https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:14:54.932017+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2023-avi-0398 certfr-2023-avi-0398 — De multiples vulnérabilités ont été découvertes dans les produits VMware Spring. Elles permettent à un attaquant de pro… 2026-10-02T17:14:55.084411+00:00 certfr-2023-avi-0398 https://cve.radiocsirt.org/vuln/euvd-2026-210695 EUVD-2026-210695 2026-10-02T17:14:55.084455+00:00 EUVD-2026-210695 https://cve.radiocsirt.org/vuln/fkie_cve-2023-20883 fkie_cve-2023-20883 2026-10-02T17:14:55.084470+00:00

In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.

 https://cve.radiocsirt.org/vuln/ghsa-xf96-w227-r7c4 GHSA-xf96-w227-r7c4 — Spring Boot Welcome Page Denial of Service 2026-10-02T17:14:55.084499+00:00

Affected: Maven: org.springframework.boot:spring-boot-autoconfigure

In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.

Specifically, an application is vulnerable if all of the conditions are true:

* The application has Spring MVC auto-configuration enabled. This is the case by default if Spring MVC is on the classpath. * The application makes use of Spring Boot's welcome page support, either static or templated. * Your application is deployed behind a proxy which caches 404 responses.

Your application is NOT vulnerable if any of the following are true:

* Spring MVC auto-configuration is disabled. This is true if WebMvcAutoConfiguration is explicitly excluded, if Spring MVC is not on the classpath, or if spring.main.web-application-type is set to a value other than SERVLET. * The application does not use Spring Boot's welcome page support. * You do not have a proxy which caches 404 responses.

Affected Spring Products and Versions

Spring Boot

3.0.0 to 3.0.6 2.7.0 to 2.7.11 2.6.0 to 2.6.14 2.5.0 to 2.5.14

Older, unsupported versions are also affected Mitigation

Users of affected versions should apply the following mitigations:

* 3.0.x users should upgrade to 3.0.7+ * 2.7.x users should upgrade to 2.7.12+ * 2.6.x users should upgrade to 2.6.15+ * 2.5.x users should upgrade to 2.5.15+

Users of older, unsupported versions should upgrade to 3.0.7+ or 2.7.12+…

 https://cve.radiocsirt.org/vuln/gsd-2023-20883 gsd-2023-20883 2026-10-02T17:14:55.084546+00:00 gsd-2023-20883 https://cve.radiocsirt.org/vuln/rhsa-2023:3641 RHSA-2023:3641 — Red Hat Security Advisory: Red Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release 2026-10-02T17:14:55.084559+00:00

snakeyaml: Denial of Service due to missing nested depth limitation for collections snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks dev-java/snakeyaml: DoS via stack overflow jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS jackson-databind: use of deeply nested arrays mina-sshd: Java unsafe deserialization vulnerability CXF: directory listing / code exfiltration CXF: SSRF Vulnerability json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) jettison: Uncontrolled Recursion in JSONArray spring-boot: Spring Boot Welcome Page DoS Vulnerability

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1247 WID-SEC-W-2023-1247 — VMware Tanzu Spring Boot: Schwachstelle ermöglicht Denial of Service 2026-10-02T17:14:55.084596+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Boot ausnutzen, um einen Denial of Service Angriff durchzuführen.