91 Spring Framework CVEs Disclosed by Broadcom, Including Critical Deserialization Flaw CVE-2026-59285 — Threadlinqs Intelligence
As of 2026-08-21, 91 Spring Framework CVEs Disclosed by Broadcom, Including Critical Deserialization Flaw CVE-2026-59285 is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 10 indicators of compromise.
Threat ID: TL-2026-2105 · Severity: CRITICAL · CVSS: 9.2 · Status: ACTIVE · Category: VULNERABILITY
Broadcom/VMware Tanzu Spring disclosed 91 CVEs on August 20, 2026 across the Spring portfolio (Spring Framework, Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration,
On August 20, 2026, Broadcom's VMware Tanzu Spring team disclosed 91 CVEs in a single coordinated release spanning Spring Framework, Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch. Sonatype's analysis of the disclosure, published the same day and quoting co-founder/CTO Brian Fox, ties the batch to 209,569 affected downstream software components tracked through Sonatype Guide, and frames it as evidence that AI-accelerated vulnerability discovery is outpacing organizations' ability to remediate: Spring security advisories rose from a historical baseline of roughly 6.5/month to 55 in March 2026 and 482 in April 2026 (across 65 projects, 370 from internal scanning and 112 from community reports) — a reported 1,700% month-over-month increase. Sonatype describes the June 2026 Spring release (which fixed the related earlier flaw CVE-2026-41699) as the largest security release in the project's 23-year history, since eclipsed by this August batch.
The most severe finding is CVE-2026-59285, an unsafe-deserialization flaw (CWE-502) in Spring for GraphQL affecting versions 2.0.0 through 2.0.4. Per Spring's own advisory, exploitation requires the application to use Jackson 2.x for JSON deserialization, expose a paginated (Connection) GraphQL field, and have specific abusable gadget classes on its classpath — when all three conditions hold, a crafted GraphQL request targeting pagination parameters can achieve remote code execution. Sonatype/hunt reporting scores it CVSS 9.2 (Critical); Spring's own advisory labels it HIGH severity. It is fixed in Spring for GraphQL 2.0.5 (OSS) and 2.0.4.1 (Enterprise Support only). This is the second unsafe-deserialization issue in the same paginated-query code path in 2026: Spring for GraphQL 1.4.6 and 2.0.4 had already been released in June 2026 to fix the earlier, related CVE-2026-41699.
The same disclosure window covers seven CVEs fixed together in Spring AI 2.0.1 (released August 21, 2026), each independently documented with its own CWE and CVSS vector:
- CVE-2026-59318 (CWE-863, Incorrect Authorization, CVSS 6.5 Medium, AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) — Spring AI advertises a per-request tool list to the model as an authorization boundary, but the DefaultToolCallingManager's global resolver fallback does not fully enforce it: an authenticated user able to manipulate model prompts can trigger dispatch of a tool never advertised to the current request, which Spring's advisory describes as enabling privilege escalation. Affects 1.0.0-1.0.9, 1.1.0-1.1.8, 2.0.0; fixed in 2.0.1 (OSS) / 2.0.0.1, 1.1.9, 1.0.10 (Enterprise Support).
- CVE-2026-47851 (CWE-674, Uncontrolled Recursion, CVSS AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, HIGH) — Spring AI's PDF Document Reader recursively parses a PDF's outline/bookmark tree with no depth limit or cycle detection; an unauthenticated attacker submitting a PDF with a deeply nested or cyclic outline tree triggers a StackOverflowError that crashes the ingestion thread (denial of service). Affects 1.0.0-1.0.9, 1.1.0-1.1.8, 2.0.0; OSS fix folded into 2.0.1, Enterprise-only fixes at 2.0.0.1/1.1.9/1.0.10.
- CVE-2026-47852 (CWE-377 Insecure Temporary File / CWE-426 Untrusted Search Path, CVSS AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) — Spring AI caches downloaded ONNX embedding models at a deterministic, world-accessible directory path; a local attacker on a multi-user host can pre-create that path and plant a malicious ONNX model file that the application loads in place of the legitimate one. Same affected/fixed versions as above.
- CVE-2026-59279 (unbounded resource allocation, CVSS AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, HIGH) — Spring AI's MCP Streamable HTTP server transport (both WebFlux and WebMvc variants) places no limit on the number of sessions it retains and, by default, requires no client authentication; a remote unauthenticated attacker sending repeated `initialize` reques
Weaknesses (CWE)
CWE-502, CWE-863, CWE-674, CWE-377, CWE-426, CWE-22, CWE-294, CWE-200
Timeline
- Spring security advisories totaled 55 in March 2026, against a historical baseline of roughly 6.5 reports per month, per Sonatype's later analysis.
- Spring security advisories spiked to 482 in April 2026 across 65 projects (370 from internal scanning, 112 from community reports) — a 1,700% month-over-month increase Sonatype attributes to AI-accelerated vulnerability discovery.
- Spring shipped what Sonatype describes as its largest security release in the project's 23-year history.
- Spring for GraphQL 1.4.6 and 2.0.4 released, fixing the earlier unsafe-deserialization flaw CVE-2026-41699 in paginated GraphQL query handling — the same code path later re-affected by CVE-2026-59285.
- Broadcom/VMware Tanzu Spring discloses 91 CVEs across Spring Framework, Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch, headlined by the critical unsafe-deserialization flaw CVE-2026-59285 in Spring for GraphQL (CVSS 9.2).
- Sonatype publishes analysis tying the disclosure to 209,569 affected downstream software components tracked via Sonatype Guide, framing it as evidence that AI-assisted vulnerability discovery is outpacing organizations' ability to remediate.
- Researcher Wayde Shi of PayPal is credited with responsibly disclosing CVE-2026-59308, the Spring AI semantic-cache cross-tenant isolation bypass caused by SHA-256 context-hash truncation.
- Spring AI 2.0.1 released, patching CVE-2026-59318 (unadvertised tool dispatch via prompt injection) plus six other CVEs: CVE-2026-47851 (PDF outline processing), CVE-2026-47852 (predictable ONNX model cache enabling local model substitution), CVE-2026-59279 (session allocation abuse), CVE-2026-59294 (arbitrary file write via path traversal in ResourceCacheService), CVE-2026-59308 (semantic cache cross-tenant isolation bypass), and CVE-2026-59319 (RediSearch tag injection in RedisChatMemoryRepository).
- Spring for GraphQL 2.0.5 (OSS) and 2.0.4.1 (Enterprise Support) released, fixing CVE-2026-59285.
- Direct check of the CISA Known Exploited Vulnerabilities catalog finds none of the eight tracked CVE IDs from this disclosure batch present, and no public PoC code is located for any of them.
Detections & IOCs
As of 2026-09-12, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 10 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-59285, CVE-2026-59318, CVE-2026-47851, CVE-2026-47852, CVE-2026-59279, CVE-2026-59294, CVE-2026-59308, CVE-2026-59319, T1190, T1059, T1505.003, T1213, T1499.003, T1499.004, T1565.001, AML.T0051.001, AML.T0010.003, AML.T0053
