# 91 Spring Framework CVEs Disclosed by Broadcom, Including Critical Deserialization Flaw CVE-2026-59285

> Broadcom/VMware Tanzu Spring disclosed 91 CVEs on August 20, 2026 across the Spring portfolio (Spring Framework, Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, Spring Batch), affecting 209,569 downstream components per Sonatype Guide. The headline flaw is CVE-2026-59285, a CWE-502 unsafe-deserialization RCE in Spring for GraphQL (CVSS 9.2 per Sonatype/hunt reporting; Spring's own advisory rates it HIGH) triggered via crafted paginated GraphQL Connection-field requests when Jackson 2.x is present; the same batch includes CVE-2026-59318, a CWE-863 incorrect-authorization flaw letting prompt injection make Spring AI's DefaultToolCallingManager dispatch tools outside a request's advertised tool list.

- **Published:** 2026-08-21T00:00:00Z
- **Last reviewed:** 2026-08-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2105
- **ID:** TL-2026-2105
- **Severity:** CRITICAL (CVSS 9.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-59285, CVE-2026-59318, CVE-2026-47851, CVE-2026-47852, CVE-2026-59279, CVE-2026-59294, CVE-2026-59308, CVE-2026-59319, CVE-2026-41699

## Description

On August 20, 2026, Broadcom's VMware Tanzu Spring team disclosed 91 CVEs in a single coordinated release spanning Spring Framework, Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch. Sonatype's analysis of the disclosure, published the same day and quoting co-founder/CTO Brian Fox, ties the batch to 209,569 affected downstream software components tracked through Sonatype Guide, and frames it as evidence that AI-accelerated vulnerability discovery is outpacing organizations' ability to remediate: Spring security advisories rose from a historical baseline of roughly 6.5/month to 55 in March 2026 and 482 in April 2026 (across 65 projects, 370 from internal scanning and 112 from community reports) — a reported 1,700% month-over-month increase. Sonatype describes the June 2026 Spring release (which fixed the related earlier flaw CVE-2026-41699) as the largest security release in the project's 23-year history, since eclipsed by this August batch.

The most severe finding is CVE-2026-59285, an unsafe-deserialization flaw (CWE-502) in Spring for GraphQL affecting versions 2.0.0 through 2.0.4. Per Spring's own advisory, exploitation requires the application to use Jackson 2.x for JSON deserialization, expose a paginated (Connection) GraphQL field, and have specific abusable gadget classes on its classpath — when all three conditions hold, a crafted GraphQL request targeting pagination parameters can achieve remote code execution. Sonatype/hunt reporting scores it CVSS 9.2 (Critical); Spring's own advisory labels it HIGH severity. It is fixed in Spring for GraphQL 2.0.5 (OSS) and 2.0.4.1 (Enterprise Support only). This is the second unsafe-deserialization issue in the same paginated-query code path in 2026: Spring for GraphQL 1.4.6 and 2.0.4 had already been released in June 2026 to fix the earlier, related CVE-2026-41699.

The same disclosure window covers seven CVEs fixed together in Spring AI 2.0.1 (released August 21, 2026), each independently documented with its own CWE and CVSS vector:
- CVE-2026-59318 (CWE-863, Incorrect Authorization, CVSS 6.5 Medium, AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) — Spring AI advertises a per-request tool list to the model as an authorization boundary, but the DefaultToolCallingManager's global resolver fallback does not fully enforce it: an authenticated user able to manipulate model prompts can trigger dispatch of a tool never advertised to the current request, which Spring's advisory describes as enabling privilege escalation. Affects 1.0.0-1.0.9, 1.1.0-1.1.8, 2.0.0; fixed in 2.0.1 (OSS) / 2.0.0.1, 1.1.9, 1.0.10 (Enterprise Support).
- CVE-2026-47851 (CWE-674, Uncontrolled Recursion, CVSS AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, HIGH) — Spring AI's PDF Document Reader recursively parses a PDF's outline/bookmark tree with no depth limit or cycle detection; an unauthenticated attacker submitting a PDF with a deeply nested or cyclic outline tree triggers a StackOverflowError that crashes the ingestion thread (denial of service). Affects 1.0.0-1.0.9, 1.1.0-1.1.8, 2.0.0; OSS fix folded into 2.0.1, Enterprise-only fixes at 2.0.0.1/1.1.9/1.0.10.
- CVE-2026-47852 (CWE-377 Insecure Temporary File / CWE-426 Untrusted Search Path, CVSS AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) — Spring AI caches downloaded ONNX embedding models at a deterministic, world-accessible directory path; a local attacker on a multi-user host can pre-create that path and plant a malicious ONNX model file that the application loads in place of the legitimate one. Same affected/fixed versions as above.
- CVE-2026-59279 (unbounded resource allocation, CVSS AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, HIGH) — Spring AI's MCP Streamable HTTP server transport (both WebFlux and WebMvc variants) places no limit on the number of sessions it retains and, by default, requires no client authentication; a remote unauthenticated attacker sending repeated `initialize` requests accumulates sessions until the server exhausts memory, denying service to legitimate users. Affects 2.0.0; fixed in 2.0.1 (OSS) / 2.0.0.1 (Enterprise Support).
- CVE-2026-59294 (CWE-22 Path Traversal, CVSS AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L, MEDIUM) — `ResourceCacheService.getCacheName()` passes an unsanitized URI fragment directly into `new File(resourceParentFolder, newFileName)`; a crafted URI fragment such as `#/../../../../opt/app/conf/override.properties`, supplied via `TransformersEmbeddingModel.setModelResource()`/`setTokenizerResource()` when accepting URIs from untrusted tenant configuration, admin UIs, or external catalogues, writes an arbitrary file outside the intended cache directory. Affects 1.0.0-1.0.9, 1.1.0-1.1.8, 2.0.0; fixed in 2.0.1 (OSS) / 2.0.0.1, 1.1.9, 1.0.10 (Enterprise Support).
- CVE-2026-59308 (CWE-294 Authentication Bypass by Capture-replay / CWE-200 Information Exposure, CVSS ~4.4, AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, MEDIUM; responsibly disclosed by Wayde Shi of PayPal) — Spring AI's semantic cache isolates cached responses between different system prompts using a truncated SHA-256 context hash; the truncation reduces entropy enough to produce collisions, letting cached responses intended for one system prompt/tenant be served to an unrelated one. Affects Spring AI 2.0.0; fixed in 2.0.1 (OSS) / 2.0.0.1 (Enterprise Support).
- CVE-2026-59319 — a RediSearch tag-injection flaw in `RedisChatMemoryRepository` that allows cross-conversation data exposure.

No evidence of in-the-wild exploitation was found for any CVE in this batch: a direct check of the CISA Known Exploited Vulnerabilities catalog on 2026-08-21 found none of the eight tracked CVE IDs (CVE-2026-59285, -59318, -47851, -47852, -59279, -59294, -59308, -59319) present, and no public PoC code was located. This is a vulnerability-disclosure event with no attributed threat actor; the risk is systemic (unpatched components across the ecosystem) rather than an observed campaign.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Web Shell
- T1213 Data from Information Repositories
- T1499.003 Application Exhaustion Flood
- T1499.004 Application or System Exploitation
- T1565.001 Stored Data Manipulation
- AML.T0051.001 Indirect
- AML.T0010.003 Model
- AML.T0053 AI Agent Tool Invocation

## Sources

- [91 Spring CVEs Highlight the Growing AI Vulnerability Consumption Problem](https://www.sonatype.com/blog/91-spring-cves-highlight-the-growing-ai-vulnerability-consumption-problem)
- [CVE-2026-59285: Spring for GraphQL Unsafe Deserialization](https://spring.io/security/cve-2026-59285)
- [CVE-2026-59318: Spring AI Tool Calling Authorization Bypass](https://spring.io/security/cve-2026-59318)
- [NVD - CVE-2026-59318](https://nvd.nist.gov/vuln/detail/CVE-2026-59318)
- [Spring AI 2.0.1 Available Now](https://spring.io/blog/2026/08/21/spring-ai-2-0-1-available-now/)
- [Spring for GraphQL 1.4.6 and 2.0.4 released](https://spring.io/blog/2026/06/10/spring-for-graphql-1-4-6-and-2-0-4-released/)
- [CVE-2026-41699: Unsafe Deserialization in Spring GraphQL](https://spring.io/security/cve-2026-41699/)
- [CVE-2026-59318 - Medium Vulnerability](https://www.thehackerwire.com/vulnerability/CVE-2026-59318/)
- [CVE-2026-59308: Spring AI Semantic Cache Cross-Tenant Isolation Bypass](https://spring.io/security/cve-2026-59308)
- [CVE-2026-59294: Arbitrary File Write via Path Traversal in ResourceCacheService](https://spring.io/security/cve-2026-59294)
- [CVE-2026-47852: Predictable ONNX Model Cache Directory in Spring AI](https://spring.io/security/cve-2026-47852)
- [CVE-2026-59279: Unbounded Persistent Session Allocation in Spring AI MCP Transport](https://spring.io/security/cve-2026-59279)
- [CVE-2026-47851: Unbounded Recursion in Spring AI PDF Document Reader](https://spring.io/security/cve-2026-47851)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2105