CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

Spring security advisory (AV26-842)

unknown
Serial Number: AV26-842 Date: August 21, 2026 As of August 20, 2026, Spring is affected by vulnerabilities in the following products: Spring AI Prior to or equal to 2.0.0 Prior to or equal to 1.0.9 Prior to or equal to 1.1.8 Spring Security Multiple versions Spring Cloud Config Multiple versions Spring Data REST Multiple versions Spring Cloud Gateway Multiple versions Spring Cloud Commons Multiple versions Spring for GraphQL Multiple versions Spring Integration Multiple versions Spring Authorization Server Prior to or equal to 1.5.8 Prior to or equal to 1.4.11 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Spring | Security Advisories

CSIRTS triage

vendor: SpringOtheraffected: Spring AI ≤2.0.0, ≤1.0.9, ≤1.1.8; Spring Security, Spring Cloud Config, Spring Data REST, Spring Cloud Gateway, Spring Cloud Commons, Spring for GraphQL, Spring Integration multiple versions; Spring A
What
Multiple unspecified vulnerabilities affect Spring framework products without CVE details disclosed.
Who is affected
Spring AI, Spring Security, Spring Cloud, and Spring Authorization Server users across the listed versions.
Urgency
Unknown; no CVE data or severity details provided; treat as pending disclosure pending official details.
Action
Monitor the Spring Security Advisories page and apply updates as they become available.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source
Canadian Centre for Cyber Security (CA · national-cert · site)
Severity
unknown
Published
2026-08-21
Exploitation
Not in CISA KEV at last sync

Original advisory: https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-842

More from Canadian Centre for Cyber Security