Threat reportVulnerabilityTL-2026-2105
91 Spring Framework CVEs Disclosed by Broadcom, Including Critical Deserialization Flaw CVE-2026-59285
91 Spring Framework CVEs Disclosed by Broadcom, Including (TL-2026-2105) is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-08-21. It has no confirmed attribution, affects Broadcom (VMware Tanzu Spring) Spring for GraphQL, references 9 CVEs (CVE-2026-59285, CVE-2026-59318, CVE-2026-47851), maps to 10 MITRE ATT&CK / ATLAS techniques (AML.T0010.003, AML.T0051.001, AML.T0053), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 9.2/10Critical
- CVEs
- 9Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK / ATLAS
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-2105
- Threat ID
- TL-2026-2105
- Severity
- CRITICAL
- CVSS
- 9.2
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in 91 Spring Framework CVEs Disclosed by Broadcom, Including
Malware and tooling: Jackson 2.x (FasterXML)
How 91 Spring Framework CVEs Disclosed by Broadcom, Including works
Broadcom/VMware Tanzu Spring disclosed 91 CVEs on August 20, 2026 across the Spring portfolio (Spring Framework, Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, Spring Batch), affecting 209,569 downstream components per Sonatype Guide. The headline flaw is CVE-2026-59285, a CWE-502 unsafe-deserialization RCE in Spring for GraphQL (CVSS 9.2 per Sonatype/hunt reporting; Spring's own advisory rates it HIGH) triggered via crafted paginated GraphQL Connection-field requests when Jackson 2.x is present; the same batch includes CVE-2026-59318, a CWE-863 incorrect-authorization flaw letting prompt injection make Spring AI's DefaultToolCallingManager dispatch tools outside a request's advertised tool list.
On August 20, 2026, Broadcom's VMware Tanzu Spring team disclosed 91 CVEs in a single coordinated release spanning Spring Framework, Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch. Sonatype's analysis of the disclosure, published the same day and quoting co-founder/CTO Brian Fox, ties the batch to 209,569 affected downstream software components tracked through Sonatype Guide, and frames it as evidence that AI-accelerated vulnerability discovery is outpacing organizations' ability to remediate: Spring security advisories rose from a historical baseline of roughly 6.5/month to 55 in March 2026 and 482 in April 2026 (across 65 projects, 370 from internal scanning and 112 from community reports) — a reported 1,700% month-over-month increase. Sonatype describes the June 2026 Spring release (which fixed the related earlier flaw CVE-2026-41699) as the largest security release in the project's 23-year history, since eclipsed by this August batch.
The most severe finding is CVE-2026-59285, an unsafe-deserialization flaw (CWE-502) in Spring for GraphQL affecting versions 2.0.0 through 2.0.4. Per Spring's own advisory, exploitation requires the application to use Jackson 2.x for JSON deserialization, expose a paginated (Connection) GraphQL field, and have specific abusable gadget classes on its classpath — when all three conditions hold, a crafted GraphQL request targeting pagination parameters can achieve remote code execution. Sonatype/hunt reporting scores it CVSS 9.2 (Critical); Spring's own advisory labels it HIGH severity. It is fixed in Spring for GraphQL 2.0.5 (OSS) and 2.0.4.1 (Enterprise Support only). This is the second unsafe-deserialization issue in the same paginated-query code path in 2026: Spring for GraphQL 1.4.6 and 2.0.4 had already been released in June 2026 to fix the earlier, related CVE-2026-41699.
The same disclosure window covers seven CVEs fixed together in Spring AI 2.0.1 (released August 21, 2026), each independently documented with its own CWE and CVSS vector: - CVE-2026-59318 (CWE-863, Incorrect Authorization, CVSS 6.5 Medium, AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) — Spring AI advertises a per-request tool list to the model as an authorization boundary, but the DefaultToolCallingManager's global resolver fallback does not fully enforce it: an authenticated user able to manipulate model prompts can trigger dispatch of a tool never advertised to the current request, which Spring's advisory describes as enabling privilege escalation. Affects 1.0.0-1.0.9, 1.1.0-1.1.8, 2.0.0; fixed in 2.0.1 (OSS) / 2.0.0.1, 1.1.9, 1.0.10 (Enterprise Support). - CVE-2026-47851 (CWE-674, Uncontrolled Recursion, CVSS AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, HIGH) — Spring AI's PDF Document Reader recursively parses a PDF's outline/bookmark tree with no depth limit or cycle detection; an unauthenticated attacker submitting a PDF with a deeply nested or cyclic outline tree triggers a StackOverflowError that crashes the ingestion thread (denial of service). Affects 1.0.0-1.0.9, 1.1.0-1.1.8, 2.0.0; OSS fix folded into 2.0.1, Enterprise-only fixes at 2.0.0.1/1.1.9/1.0.10. - CVE-2026-47852 (CWE-377 Insecure Temporary File / CWE-426 Untrusted Search Path, CVSS AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) — Spring AI caches downloaded ONNX embedding models at a deterministic, world-accessible directory path; a local attacker on a multi-user host can pre-create that path and plant a malicious ONNX model file that the application loads in place of the legitimate one. Same affected/fixed versions as above. - CVE-2026-59279 (unbounded resource allocation, CVSS AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, HIGH) — Spring AI's MCP Streamable HTTP server transport (both WebFlux and WebMvc variants) places no limit on the number of sessions it retains and, by default, requires no client authentication; a remote unauthenticated attacker sending repeated `initialize` requests accumulates sessions until the server exhausts memory, denying service to legitimate users. Affects 2.0.0; fixed in 2.0.1 (OSS) / 2.0.0.1 (Enterprise Support). - CVE-2026-59294 (CWE-22 Path Traversal, CVSS AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L, MEDIUM) — `ResourceCacheService.getCacheName()` passes an unsanitized URI fragment directly into `new File(resourceParentFolder, newFileName)`; a crafted URI fragment such as `#/../../../../opt/app/conf/override.properties`, supplied via `TransformersEmbeddingModel.setModelResource()`/`setTokenizerResource()` when accepting URIs from untrusted tenant configuration, admin UIs, or external catalogues, writes an arbitrary file outside the intended cache directory. Affects 1.0.0-1.0.9, 1.1.0-1.1.8, 2.0.0; fixed in 2.0.1 (OSS) / 2.0.0.1, 1.1.9, 1.0.10 (Enterprise Support). - CVE-2026-59308 (CWE-294 Authentication Bypass by Capture-replay / CWE-200 Information Exposure, CVSS ~4.4, AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, MEDIUM; responsibly disclosed by Wayde Shi of PayPal) — Spring AI's semantic cache isolates cached responses between different system prompts using a truncated SHA-256 context hash; the truncation reduces entropy enough to produce collisions, letting cached responses intended for one system prompt/tenant be served to an unrelated one. Affects Spring AI 2.0.0; fixed in 2.0.1 (OSS) / 2.0.0.1 (Enterprise Support). - CVE-2026-59319 — a RediSearch tag-injection flaw in `RedisChatMemoryRepository` that allows cross-conversation data exposure.
No evidence of in-the-wild exploitation was found for any CVE in this batch: a direct check of the CISA Known Exploited Vulnerabilities catalog on 2026-08-21 found none of the eight tracked CVE IDs (CVE-2026-59285, -59318, -47851, -47852, -59279, -59294, -59308, -59319) present, and no public PoC code was located. This is a vulnerability-disclosure event with no attributed threat actor; the risk is systemic (unpatched components across the ecosystem) rather than an observed campaign.
MITRE ATT&CK / ATLAS techniques used in TL-2026-2105
Initial Access
AML.T0010.003 Model; T1190 Exploit Public-Facing Application
execution
Privilege Escalation
AML.T0053 AI Agent Tool Invocation
Execution
T1059 Command and Scripting Interpreter
Collection
T1213 Data from Information Repositories
Impact
T1499.003 Application Exhaustion Flood; T1499.004 Application or System Exploitation; T1565.001 Stored Data Manipulation
Persistence
Affected products and versions in 91 Spring Framework CVEs Disclosed by Broadcom, Including
- Broadcom (VMware Tanzu Spring) — Spring for GraphQL
Vulnerable versions: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4
Fixed in: 2.0.5 (OSS); 2.0.4.1 (Enterprise Support) - Broadcom (VMware Tanzu Spring) — Spring AI
Vulnerable versions: 1.0.0-1.0.9; 1.1.0-1.1.8; 2.0.0
Fixed in: 2.0.1 (OSS); 2.0.0.1 / 1.1.9 / 1.0.10 (Enterprise Support)
Remediation for 91 Spring Framework CVEs Disclosed by Broadcom, Including
Patches
- Spring for GraphQL 2.0.5 (OSS) / 2.0.4.1 (Enterprise Support)
- Spring AI 2.0.1 (OSS) / 2.0.0.1, 1.1.9, 1.0.10 (Enterprise Support)
Immediate actions
- Upgrade Spring for GraphQL to 2.0.5 (OSS) or 2.0.4.1 (Enterprise Support) to remediate CVE-2026-59285.
- Upgrade Spring AI to 2.0.1 to remediate CVE-2026-59318 and the six other CVEs patched in that release (CVE-2026-47851, CVE-2026-47852, CVE-2026-59279, CVE-2026-59294, CVE-2026-59308, CVE-2026-59319).
- Where an immediate upgrade is not possible, audit GraphQL schemas for exposed paginated (Connection) fields and review the classpath for classes exploitable during Jackson 2.x deserialization.
- Audit any code path that feeds externally-influenced URIs into TransformersEmbeddingModel.setModelResource()/setTokenizerResource() for path-traversal sequences until CVE-2026-59294 is patched.
- Restrict permissions on Spring AI's ONNX model cache directory and disable multi-tenant/multi-user access to hosts running unpatched Spring AI to mitigate CVE-2026-47852.
Workarounds
- Disable or restrict paginated GraphQL Connection fields until Spring for GraphQL is upgraded.
- Explicitly configure Spring AI tool resolution to fail closed rather than falling back to a global resolver.
- Place an authenticating reverse proxy in front of any Spring AI MCP Streamable HTTP transport endpoint until CVE-2026-59279 is patched.
Longer-term hardening
- Use dependency-scanning/Sonatype Guide alerts to prioritize remediation across the 209,569 downstream components identified as affected by this disclosure batch.
- Adopt Spring AI 2.0.1's configurable tool-resolution boundary (opt-in fallback) instead of relying on default permissive tool dispatch.
- Review AI agent deployments for indirect prompt-injection exposure anywhere untrusted data can reach an LLM's tool-calling context.
- Require authentication and cap session counts on any MCP Streamable HTTP transport endpoint to prevent session-exhaustion DoS.
- Add recursion-depth limits/cycle detection around any document-outline or tree-structured parser that processes untrusted input.
CVEs associated with 91 Spring Framework CVEs Disclosed by Broadcom, Including
CVE-2026-59285, CVE-2026-59318, CVE-2026-47851, CVE-2026-47852, CVE-2026-59279, CVE-2026-59294, CVE-2026-59308, CVE-2026-59319, CVE-2026-41699
Weaknesses (CWE) in 91 Spring Framework CVEs Disclosed by Broadcom, Including
CWE-502, CWE-863, CWE-674, CWE-377, CWE-426, CWE-22, CWE-294, CWE-200
Timeline of 91 Spring Framework CVEs Disclosed by Broadcom, Including
- Spring security advisories totaled 55 in March 2026, against a historical baseline of roughly 6.5 reports per month, per Sonatype's later analysis.
- Spring security advisories spiked to 482 in April 2026 across 65 projects (370 from internal scanning, 112 from community reports) — a 1,700% month-over-month increase Sonatype attributes to AI-accelerated vulnerability discovery.
- Spring shipped what Sonatype describes as its largest security release in the project's 23-year history.
- Spring for GraphQL 1.4.6 and 2.0.4 released, fixing the earlier unsafe-deserialization flaw CVE-2026-41699 in paginated GraphQL query handling — the same code path later re-affected by CVE-2026-59285.
- Researcher Wayde Shi of PayPal is credited with responsibly disclosing CVE-2026-59308, the Spring AI semantic-cache cross-tenant isolation bypass caused by SHA-256 context-hash truncation.
- Sonatype publishes analysis tying the disclosure to 209,569 affected downstream software components tracked via Sonatype Guide, framing it as evidence that AI-assisted vulnerability discovery is outpacing organizations' ability to remediate.
- Broadcom/VMware Tanzu Spring discloses 91 CVEs across Spring Framework, Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch, headlined by the critical unsafe-deserialization flaw CVE-2026-59285 in Spring for GraphQL (CVSS 9.2).
- Direct check of the CISA Known Exploited Vulnerabilities catalog finds none of the eight tracked CVE IDs from this disclosure batch present, and no public PoC code is located for any of them.
- Spring for GraphQL 2.0.5 (OSS) and 2.0.4.1 (Enterprise Support) released, fixing CVE-2026-59285.
- Spring AI 2.0.1 released, patching CVE-2026-59318 (unadvertised tool dispatch via prompt injection) plus six other CVEs: CVE-2026-47851 (PDF outline processing), CVE-2026-47852 (predictable ONNX model cache enabling local model substitution), CVE-2026-59279 (session allocation abuse), CVE-2026-59294 (arbitrary file write via path traversal in ResourceCacheService), CVE-2026-59308 (semantic cache cross-tenant isolation bypass), and CVE-2026-59319 (RediSearch tag injection in RedisChatMemoryRepository).
Sources cited for 91 Spring Framework CVEs Disclosed by Broadcom, Including
- 91 Spring CVEs Highlight the Growing AI Vulnerability Consumption Problem
- CVE-2026-59285: Spring for GraphQL Unsafe Deserialization
- CVE-2026-59318: Spring AI Tool Calling Authorization Bypass
- NVD - CVE-2026-59318
- Spring AI 2.0.1 Available Now
- Spring for GraphQL 1.4.6 and 2.0.4 released
- CVE-2026-41699: Unsafe Deserialization in Spring GraphQL
- CVE-2026-59318 - Medium Vulnerability
- CVE-2026-59308: Spring AI Semantic Cache Cross-Tenant Isolation Bypass
- CVE-2026-59294: Arbitrary File Write via Path Traversal in ResourceCacheService
- CVE-2026-47852: Predictable ONNX Model Cache Directory in Spring AI
- CVE-2026-59279: Unbounded Persistent Session Allocation in Spring AI MCP Transport
- CVE-2026-47851: Unbounded Recursion in Spring AI PDF Document Reader
Detection coverage for TL-2026-2105
As of 2026-08-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2105 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.