The developers of Broadcom’s Spring application development framework last week announced the release of updates that patch 91 vulnerabilities.
Spring is an open source application framework for the Java platform that simplifies the creation of enterprise applications through features such as dependency injection, aspect-oriented programming, and modular support for web, data, and messaging architectures. After years under VMware’s stewardship, it transitioned to Broadcom following its acquisition of VMware.
A single vulnerability has been assigned a critical severity rating: CVE-2026-59270. It affects Spring Security’s embedded UnboundID LDAP server and could allow an attacker to authenticate and modify entries in the in-memory directory.
Over a dozen vulnerabilities have been classified as high severity. They can be exploited for XSS attacks, information disclosure, remote code execution, DoS attacks, security bypasses, and unauthorized access.
The remaining vulnerabilities have medium and low severity ratings.
Cybersecurity firm Sonatype has analyzed the patches and found that they impact more than 200,000 software components. The security flaws affect projects such as Spring Security, Spring AI, Cloud Config, Data REST, Integration, Reactor Core, Reactor Netty, AMQP, and Batch.
Sonatype has highlighted two vulnerabilities: CVE-2026-59285, which it describes as a critical remote code execution issue in Spring for GraphQL, and CVE-2026-59318, a medium-severity issue in Spring AI’s tool-calling functionality that can allow privilege escalation through prompt injection.
The surge in Spring vulnerabilities is unsurprisingly driven by Broadcom’s use of AI.
More than 200 vulnerabilities have been patched to date this year, compared to only 16 in 2025 and 22 in 2024.
Spring vulnerabilities can be useful to threat actors, and they have been exploited in the wild, including the notorious Spring4Shell. CISA’s KEV catalog currently includes several such vulnerabilities.
Open source projects are advised to review the latest Spring patches and apply them.
Related: Critical Isolated-vm Vulnerability Leads to RCE on Host
Related: CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities
Related: Hackers Target Zimbra Servers in Active Exploitation Campaign