Broadcom recently released updates to address 91 security vulnerabilities in the Spring application development framework. As a leading open source framework for Java, Spring facilitates the development of enterprise applications through its advanced features such as dependency injection and modular architecture support. Originally managed by VMware, the framework transitioned to Broadcom following the latter’s acquisition of VMware.
Critical Vulnerability and High-Risk Issues
Among the identified vulnerabilities, one stands out with a critical severity rating: CVE-2026-59270. This flaw is found in Spring Security’s embedded UnboundID LDAP server and poses a risk of unauthorized access, allowing attackers to authenticate and alter directory entries.
Apart from this critical issue, the update also addresses over a dozen high-severity vulnerabilities. These vulnerabilities are exploitable for cross-site scripting (XSS) attacks, information leakage, remote code execution, denial-of-service (DoS) attacks, security circumvention, and unauthorized access.
Impact on Software Components
Cybersecurity firm Sonatype conducted an analysis of the patches and found that more than 200,000 software components were impacted. The security flaws affect several Spring projects, including Spring Security, Spring AI, Cloud Config, Data REST, and others.
Sonatype has also emphasized two specific vulnerabilities: CVE-2026-59285, a critical remote code execution issue in Spring for GraphQL, and CVE-2026-59318, a medium-severity vulnerability in Spring AI’s tool-calling feature, which could allow privilege escalation through prompt injection.
Rising Number of Vulnerabilities and Recommendations
The increase in detected vulnerabilities within the Spring framework is attributed to Broadcom’s integration of AI technologies. This year alone, over 200 vulnerabilities have been addressed, a significant rise compared to previous years, which reported only 16 in 2025 and 22 in 2024.
Spring vulnerabilities are valuable targets for threat actors and have been exploited in attacks such as Spring4Shell. The Cybersecurity and Infrastructure Security Agency (CISA) has listed several of these vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog.
Open source projects utilizing the Spring framework are strongly advised to review and implement the latest patches to safeguard their applications against potential threats.
For additional context, related security alerts include the critical isolated-vm vulnerability leading to remote code execution on hosts, CISA’s call for immediate patching of exploited TrueConf vulnerabilities, and ongoing exploitation campaigns targeting Zimbra servers.
