CVE-2016-1000027
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
Pivotal Spring Framework through 5.3.16 may allow remote code execution (RCE) when deserializing untrusted Java data. The issue may or may not occur depending on the library's implementation in a product, and authentication may be required. The vendor states that untrusted data is not an intended use case.
Risk Assessment
Risk of remote code execution in applications using Spring Framework for deserialization, potentially leading to full system compromise.
Recommendation
Upgrade Spring Framework to the latest available version and avoid deserializing untrusted data. If possible, implement authentication and input filtering mechanisms.
Other vulnerabilities in Spring Framework
See all- CVE-2014-0225High
The Spring Framework versions from 4.0.0 to 4.0.4 and from 3.0.0 to 3.2.8, as well as possibly earlier unsupported versions, did not disable by default the resolution of URI references in a DTD declaration when processing user-provided XML documents. This enabled an XXE attack.
- CVE-2026-59313Critical
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Affects Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, and 5.3.0-5.3.49.
- CVE-2026-59283Critical
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Affects multiple versions of Spring Framework.
- CVE-2026-47892Critical
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.5.RELEASE-5.2.25.RELEASE.
- CVE-2026-47891Critical
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.
- CVE-2026-47890Critical
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Affected versions: Spring Framework 7.0.0-7.0.8 and 6.2.0-6.2.19.
- CVE-2022-22968Medium
In Spring Framework versions 5.3.0-5.3.18, 5.2.0-5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
- CVE-2022-22965CriticalActively exploited
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment; applications deployed as Spring Boot executable jars are not vulnerable to this specific exploit, but the vulnerability is more general in nature.
- CVE-2022-22950Medium
In Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
- CVE-2020-5421Medium
In Spring Framework versions 5.2.0-5.2.8, 5.1.0-5.1.17, 5.0.0-5.0.18, 4.3.0-4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
Original NVD description (English source)
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS