Skip to content

spring-boot-starter-web-2.6.1.jar: 33 vulnerabilities (highest severity is: 9.3) [main] (reachable) #7

Open
Open
spring-boot-starter-web-2.6.1.jar: 33 vulnerabilities (highest severity is: 9.3) [main] (reachable)#7
@mend-developer-platform-dev

Description

@mend-developer-platform-dev
mend-developer-platform-dev
bot
opened on Sep 28, 2025
📂 Vulnerable Library - spring-boot-starter-web-2.6.1.jar

Starter for building web, including RESTful, applications using Spring MVC. Uses Tomcat as the default embedded container

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework.boot/spring-boot-starter-web/2.6.1/145ac0cfb81982608ef0d19e32699c0eeeb3c2ab/spring-boot-starter-web-2.6.1.jar

Partial results (13 findings) are displayed below due to a content size limitation in GitHub. To view information on the remaining findings, navigate to the Mend Application.

Findings

Finding Severity 🎯 CVSS Exploit Maturity EPSS Library Type Fixed in Remediation Available Reachability
CVE-2022-22965 🟣 Critical 9.3 High 94.4% spring-beans-5.3.13.jar Transitive N/A ❌ Reachable
CVE-2020-36518 🔴 High 8.7 Not Defined < 1% jackson-databind-2.13.0.jar Transitive N/A ❌ Reachable
CVE-2021-46877 🔴 High 8.7 Not Defined < 1% jackson-databind-2.13.0.jar Transitive N/A ❌ Reachable
CVE-2022-42003 🔴 High 8.7 Not Defined < 1% jackson-databind-2.13.0.jar Transitive N/A ❌ Reachable
CVE-2022-42004 🔴 High 8.7 Not Defined < 1% jackson-databind-2.13.0.jar Transitive N/A ❌ Reachable
CVE-2022-45143 🔴 High 8.7 Not Defined < 1% tomcat-embed-core-9.0.55.jar Transitive N/A ❌ Reachable
CVE-2023-20860 🔴 High 8.7 Not Defined 63.300003% spring-webmvc-5.3.13.jar Transitive N/A ❌ Reachable
CVE-2023-24998 🔴 High 8.7 Not Defined 37.7% tomcat-embed-core-9.0.55.jar Transitive N/A ❌ Reachable
CVE-2025-48988 🔴 High 8.7 Not Defined < 1% tomcat-embed-core-9.0.55.jar Transitive N/A ❌ Reachable
CVE-2025-48989 🔴 High 8.7 Not Defined < 1% tomcat-embed-core-9.0.55.jar Transitive N/A ❌ Reachable
CVE-2025-52999 🔴 High 8.7 Not Defined < 1% jackson-core-2.13.0.jar Transitive N/A ❌ Reachable
CVE-2018-1271 🔴 High 8.2 Not Defined 91.2% spring-core-5.3.13.jar Transitive N/A ❌ Reachable
CVE-2025-41242 🔴 High 8.2 Not Defined < 1% spring-webmvc-5.3.13.jar Transitive N/A ❌ Reachable

Details

🟣CVE-2022-22965

Vulnerable Library - spring-beans-5.3.13.jar

Spring Beans

Library home page: https://spring.io/projects/spring-framework

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-beans/5.3.13/1d90c96b287253ec371260c35fbbea719c24bad6/spring-beans-5.3.13.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)
    • spring-webmvc-5.3.13.jar
      • spring-aop-5.3.13.jar
        • ❌ spring-beans-5.3.13.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.SpringApplication (Extension)
        -> ❌ org.springframework.beans.CachedIntrospectionResults (Vulnerable Component)

Vulnerability Details

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. Converted from WS-2022-0107, on 2022-11-07.

Publish Date: Apr 01, 2022 10:17 PM

URL: CVE-2022-22965

Threat Assessment

Exploit Maturity:High

EPSS:94.4%

Score: 9.3

Suggested Fix

Type: Upgrade version

Origin: GHSA-36p3-wjmg-h94x

Release Date: Apr 01, 2022 10:17 PM

Fix Resolution : org.springframework:spring-webflux:5.2.20.RELEASE,org.springframework:spring-webflux:5.3.18,org.springframework:spring-webmvc:5.3.18,org.springframework:spring-webmvc:5.2.20.RELEASE,org.springframework:spring-beans:5.2.20.RELEASE,org.springframework.boot:spring-boot-starter-webflux:2.5.12,org.springframework.boot:spring-boot-starter-webflux:2.6.6,org.springframework:spring-beans:5.3.18,org.springframework.boot:spring-boot-starter-web:2.5.12,org.springframework.boot:spring-boot-starter-web:2.6.6

🔴CVE-2020-36518

Vulnerable Library - jackson-databind-2.13.0.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.13.0/889672a1721d6d85b2834fcd29d3fda92c8c8891/jackson-databind-2.13.0.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)
    • spring-boot-starter-json-2.6.1.jar
      • ❌ jackson-databind-2.13.0.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.SpringApplication (Extension)
        - org.springframework.boot.web.servlet.support.SpringBootServletInitializer$WebEnvironmentPropertySourceInitializer (Extension)
            - org.springframework.boot.web.servlet.support.SpringBootServletInitializer (Extension)
                - org.springframework.boot.context.logging.LoggingApplicationListener (Extension)
                    - org.springframework.boot.logging.log4j2.Log4J2LoggingSystem (Extension)
                        - org.apache.logging.log4j.core.config.ConfigurationFactory (Extension)
                            - org.apache.logging.log4j.core.config.builder.impl.DefaultConfigurationBuilder (Extension)
                                - org.apache.logging.log4j.core.async.AsyncLoggerConfig (Extension)
                                    - org.apache.logging.log4j.core.jackson.MarkerMixIn (Extension)
                                        - com.fasterxml.jackson.databind.annotation.JsonDeserialize (Extension)
                                            -> ❌ com.fasterxml.jackson.databind.deser.std.UntypedObjectDeserializer$Vanilla (Vulnerable Component)

Vulnerability Details

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. After conducting further research, Mend has determined that all versions of com.fasterxml.jackson.core:jackson-databind up to version 2.13.2 are vulnerable to CVE-2020-36518.

Publish Date: Mar 11, 2022 12:00 AM

URL: CVE-2020-36518

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-57j2-w4cx-62h2

Release Date: Mar 11, 2022 12:00 AM

Fix Resolution : com.fasterxml.jackson.core:jackson-databind:2.13.2.1,com.fasterxml.jackson.core:jackson-databind:2.12.6.1

🔴CVE-2021-46877

Vulnerable Library - jackson-databind-2.13.0.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.13.0/889672a1721d6d85b2834fcd29d3fda92c8c8891/jackson-databind-2.13.0.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)
    • spring-boot-starter-json-2.6.1.jar
      • ❌ jackson-databind-2.13.0.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.autoconfigure.SpringBootApplication (Extension)
        - org.springframework.boot.autoconfigure.AutoConfigurationImportSelector (Extension)
            - org.springframework.boot.context.properties.bind.Binder (Extension)
                - org.springframework.boot.context.config.ConfigDataEnvironmentContributors$InactiveSourceChecker (Extension)
                    - org.springframework.boot.context.config.ConfigDataEnvironmentContributors (Extension)
                        - org.springframework.boot.DefaultBootstrapContext (Extension)
                            - org.springframework.boot.web.servlet.support.SpringBootServletInitializer$WebEnvironmentPropertySourceInitializer (Extension)
                                - org.springframework.boot.web.servlet.support.SpringBootServletInitializer (Extension)
                                    - org.springframework.boot.context.logging.LoggingApplicationListener (Extension)
                                        - org.springframework.boot.logging.log4j2.Log4J2LoggingSystem (Extension)
                                            - org.apache.logging.log4j.core.config.ConfigurationSource (Extension)
                                                - org.apache.logging.log4j.core.config.yaml.YamlConfigurationFactory (Extension)
                                                    - org.apache.logging.log4j.core.config.yaml.YamlConfiguration (Extension)
                                                        - org.apache.logging.log4j.core.jackson.LogEventWithContextListMixIn (Extension)
                                                            - com.fasterxml.jackson.databind.annotation.JsonSerialize (Extension)
                                                                - com.fasterxml.jackson.databind.util.Converter$None (Extension)
                                                                    - com.fasterxml.jackson.databind.type.TypeFactory (Extension)
                                                                        - com.fasterxml.jackson.databind.node.BaseJsonNode (Extension)
                                                                            -> ❌ com.fasterxml.jackson.databind.node.NodeSerialization (Vulnerable Component)

Vulnerability Details

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

Publish Date: Mar 18, 2023 12:00 AM

URL: CVE-2021-46877

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-3x8x-79m2-3w2w

Release Date: Mar 18, 2023 12:00 AM

Fix Resolution : com.fasterxml.jackson.core:jackson-databind:2.12.6,com.fasterxml.jackson.core:jackson-databind:2.13.1

🔴CVE-2022-42003

Vulnerable Library - jackson-databind-2.13.0.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.13.0/889672a1721d6d85b2834fcd29d3fda92c8c8891/jackson-databind-2.13.0.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)
    • spring-boot-starter-json-2.6.1.jar
      • ❌ jackson-databind-2.13.0.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.SpringApplication (Extension)
        - org.springframework.boot.web.servlet.support.SpringBootServletInitializer$WebEnvironmentPropertySourceInitializer (Extension)
            - org.springframework.boot.web.servlet.support.SpringBootServletInitializer (Extension)
                - org.springframework.boot.context.logging.LoggingApplicationListener (Extension)
                    - org.springframework.boot.logging.log4j2.Log4J2LoggingSystem (Extension)
                        - org.apache.logging.log4j.core.config.LoggerConfig (Extension)
                            - org.apache.logging.log4j.core.config.properties.PropertiesConfiguration (Extension)
                                - org.apache.logging.log4j.core.jackson.LogEventJsonMixIn (Extension)
                                    - com.fasterxml.jackson.databind.annotation.JsonSerialize (Extension)
                                        - com.fasterxml.jackson.databind.JsonSerializer$None (Extension)
                                            - com.fasterxml.jackson.databind.ser.impl.UnwrappingBeanPropertyWriter$1 (Extension)
                                                - com.fasterxml.jackson.databind.jsonFormatVisitors.JsonArrayFormatVisitor$Base (Extension)
                                                    - com.fasterxml.jackson.databind.ser.impl.UnwrappingBeanSerializer (Extension)
                                                        - com.fasterxml.jackson.databind.introspect.AnnotatedMethod (Extension)
                                                            - com.fasterxml.jackson.databind.introspect.AnnotatedClass (Extension)
                                                                - com.fasterxml.jackson.databind.introspect.AnnotationIntrospectorPair (Extension)
                                                                    -> ❌ com.fasterxml.jackson.databind.deser.std.StdDeserializer (Vulnerable Component)

Vulnerability Details

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. For 2.13.4.x, the vulnerability is fixed in 2.13.4.1. A micro-patch was added in 2.13.4.2 to address issues for Gradle users.

Publish Date: Oct 02, 2022 12:00 AM

URL: CVE-2022-42003

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-jjjh-jjxp-wpff

Release Date: Oct 02, 2022 12:00 AM

Fix Resolution : com.fasterxml.jackson.core:jackson-databind:2.13.4.2,com.fasterxml.jackson.core:jackson-databind:2.12.7.1

🔴CVE-2022-42004

Vulnerable Library - jackson-databind-2.13.0.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://fasterxml.com/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.13.0/889672a1721d6d85b2834fcd29d3fda92c8c8891/jackson-databind-2.13.0.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)
    • spring-boot-starter-json-2.6.1.jar
      • ❌ jackson-databind-2.13.0.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.autoconfigure.SpringBootApplication (Extension)
        - org.springframework.boot.autoconfigure.AutoConfigurationImportSelector (Extension)
            - org.springframework.boot.context.properties.bind.Binder (Extension)
                - org.springframework.boot.context.config.ConfigDataEnvironmentContributors$InactiveSourceChecker (Extension)
                    - org.springframework.boot.context.config.ConfigDataEnvironmentContributors (Extension)
                        - org.springframework.boot.DefaultBootstrapContext (Extension)
                            - org.springframework.boot.web.servlet.support.SpringBootServletInitializer$WebEnvironmentPropertySourceInitializer (Extension)
                                - org.springframework.boot.web.servlet.support.SpringBootServletInitializer (Extension)
                                    - org.springframework.boot.context.logging.LoggingApplicationListener (Extension)
                                        - org.springframework.boot.logging.log4j2.Log4J2LoggingSystem (Extension)
                                            - org.apache.logging.log4j.core.config.LoggerConfig (Extension)
                                                - org.apache.logging.log4j.core.appender.MemoryMappedFileAppender (Extension)
                                                    - org.apache.logging.log4j.core.layout.YamlLayout (Extension)
                                                        - org.apache.logging.log4j.core.layout.JacksonFactory$YAML (Extension)
                                                            - com.fasterxml.jackson.databind.ObjectMapper (Extension)
                                                                -> ❌ com.fasterxml.jackson.databind.deser.BeanDeserializer (Vulnerable Component)

Vulnerability Details

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.

Publish Date: Oct 02, 2022 12:00 AM

URL: CVE-2022-42004

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-rgv9-q543-rqg4

Release Date: Oct 02, 2022 12:00 AM

Fix Resolution : com.fasterxml.jackson.core:jackson-databind:2.12.7.1,com.fasterxml.jackson.core:jackson-databind:2.13.4

🔴CVE-2022-45143

Vulnerable Library - tomcat-embed-core-9.0.55.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.55/6ab68425d34f35e93cf97e1950c2c710161d8ce1/tomcat-embed-core-9.0.55.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)
    • spring-boot-starter-tomcat-2.6.1.jar
      • tomcat-embed-websocket-9.0.55.jar
        • ❌ tomcat-embed-core-9.0.55.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.SpringApplication (Extension)
        - org.springframework.boot.web.servlet.support.SpringBootServletInitializer$WebEnvironmentPropertySourceInitializer (Extension)
            - org.springframework.boot.web.servlet.support.SpringBootServletInitializer (Extension)
                - org.springframework.boot.context.logging.LoggingApplicationListener (Extension)
                    - org.springframework.boot.web.reactive.filter.OrderedHiddenHttpMethodFilter (Extension)
                        - org.springframework.web.filter.reactive.HiddenHttpMethodFilter (Extension)
                            - org.springframework.web.server.ServerWebExchange (Extension)
                                - org.springframework.http.server.reactive.TomcatHttpHandlerAdapter$TomcatServerHttpResponse (Extension)
                                    - org.apache.catalina.connector.CoyoteOutputStream (Extension)
                                        - org.apache.catalina.connector.OutputBuffer (Extension)
                                            - org.apache.catalina.connector.CoyoteAdapter (Extension)
                                                -> ❌ org.apache.catalina.valves.JsonErrorReportValve (Vulnerable Component)

Vulnerability Details

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output. After conducting further research, Mend has determined that versions 10.0.x of org.apache.tomcat:tomcat-catalina are vulnerable to CVE-2022-45143.

Publish Date: Jan 03, 2023 06:12 PM

URL: CVE-2022-45143

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-rq2w-37h9-vg94

Release Date: Jan 03, 2023 06:12 PM

Fix Resolution : org.apache.tomcat.embed:tomcat-embed-core:10.1.2,org.apache.tomcat.embed:tomcat-embed-core:9.0.69,org.apache.tomcat:tomcat-util:8.5.84,org.apache.tomcat:tomcat-util:9.0.69,org.apache.tomcat:tomcat-catalina:10.1.2,org.apache.tomcat.embed:tomcat-embed-core:8.5.84

🔴CVE-2023-20860

Vulnerable Library - spring-webmvc-5.3.13.jar

Spring Web MVC

Library home page: https://spring.io/projects/spring-framework

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-webmvc/5.3.13/cea31c85fa84dbd9f8df14a3ca62ab57c25cabe4/spring-webmvc-5.3.13.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)
    • ❌ spring-webmvc-5.3.13.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.SpringApplication (Extension)
        - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory (Extension)
            - org.springframework.beans.factory.annotation.QualifierAnnotationAutowireCandidateResolver (Extension)
                - org.springframework.test.web.servlet.setup.StubWebApplicationContext$StubBeanFactory (Extension)
                    - org.springframework.test.context.testng.AbstractTransactionalTestNGSpringContextTests (Extension)
                        - org.springframework.test.context.web.ServletTestExecutionListener (Extension)
                            - org.springframework.test.web.servlet.htmlunit.HtmlUnitRequestBuilder$HtmlUnitMockHttpServletRequest (Extension)
                                - org.springframework.test.web.servlet.htmlunit.HtmlUnitRequestBuilder (Extension)
                                    - org.springframework.test.web.servlet.htmlunit.MockMvcWebConnection (Extension)
                                        - org.springframework.test.web.servlet.client.MockMvcWebTestClient$1 (Extension)
                                            - org.springframework.test.web.servlet.client.MockMvcWebTestClient (Extension)
                                                - org.springframework.test.web.servlet.client.ApplicationContextMockMvcSpec (Extension)
                                                    - org.springframework.test.web.servlet.setup.MockMvcBuilders (Extension)
                                                        - org.springframework.test.web.servlet.setup.StandaloneMockMvcBuilder (Extension)
                                                            - org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter (Extension)
                                                                - org.springframework.web.servlet.mvc.method.annotation.RequestResponseBodyMethodProcessor (Extension)
                                                                    - org.springframework.web.servlet.mvc.method.annotation.AbstractMessageConverterMethodProcessor (Extension)
                                                                        - org.springframework.web.servlet.handler.HandlerMappingIntrospector$PathSettingHandlerMapping (Extension)
                                                                            -> ❌ org.springframework.web.servlet.handler.HandlerMappingIntrospector (Vulnerable Component)

Vulnerability Details

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.

Publish Date: Mar 27, 2023 12:00 AM

URL: CVE-2023-20860

Threat Assessment

Exploit Maturity:Not Defined

EPSS:63.300003%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🔴CVE-2023-24998

Vulnerable Library - tomcat-embed-core-9.0.55.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.55/6ab68425d34f35e93cf97e1950c2c710161d8ce1/tomcat-embed-core-9.0.55.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)
    • spring-boot-starter-tomcat-2.6.1.jar
      • tomcat-embed-websocket-9.0.55.jar
        • ❌ tomcat-embed-core-9.0.55.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.SpringApplication (Extension)
        - org.springframework.boot.web.servlet.support.SpringBootServletInitializer$WebEnvironmentPropertySourceInitializer (Extension)
            - org.springframework.boot.web.servlet.support.SpringBootServletInitializer (Extension)
                - org.springframework.boot.context.logging.LoggingApplicationListener (Extension)
                    - org.springframework.boot.web.reactive.filter.OrderedHiddenHttpMethodFilter (Extension)
                        - org.springframework.web.filter.reactive.HiddenHttpMethodFilter (Extension)
                            - org.springframework.web.server.ServerWebExchangeDecorator (Extension)
                                - org.springframework.http.server.reactive.TomcatHttpHandlerAdapter$TomcatServerHttpResponse (Extension)
                                    - org.apache.catalina.connector.Response (Extension)
                                        - org.apache.catalina.session.StandardSession (Extension)
                                            - org.apache.catalina.session.StandardManager (Extension)
                                                - org.apache.catalina.startup.UserConfig (Extension)
                                                    -> ❌ org.apache.catalina.valves.SemaphoreValve (Vulnerable Component)

Vulnerability Details

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

Note that, like all of the file upload limits, the
new configuration option (FileUploadBase#setFileCountMax) is not
enabled by default and must be explicitly configured.

Publish Date: Feb 20, 2023 03:57 PM

URL: CVE-2023-24998

Threat Assessment

Exploit Maturity:Not Defined

EPSS:37.7%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-hfrx-6qgj-fp6c

Release Date: Feb 20, 2023 03:57 PM

Fix Resolution : commons-fileupload:commons-fileupload:1.5,org.apache.tomcat.embed:tomcat-embed-core:9.0.71,org.apache.tomcat:tomcat-coyote:11.0.0-M5,org.apache.tomcat.embed:tomcat-embed-core:10.1.5,org.apache.tomcat.embed:tomcat-embed-core:11.0.0-M5,org.apache.tomcat.embed:tomcat-embed-core:8.5.88,org.apache.tomcat:tomcat-coyote:8.5.88,org.apache.tomcat:tomcat-coyote:10.1.5,org.apache.tomcat:tomcat-coyote:9.0.71

🔴CVE-2025-48988

Vulnerable Library - tomcat-embed-core-9.0.55.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.55/6ab68425d34f35e93cf97e1950c2c710161d8ce1/tomcat-embed-core-9.0.55.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)
    • spring-boot-starter-tomcat-2.6.1.jar
      • tomcat-embed-websocket-9.0.55.jar
        • ❌ tomcat-embed-core-9.0.55.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.SpringApplication (Extension)
        - org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext (Extension)
            - org.springframework.web.context.support.GenericWebApplicationContext (Extension)
                - org.springframework.web.filter.AbstractRequestLoggingFilter (Extension)
                    - org.springframework.web.multipart.support.RequestPartServletServerHttpRequest (Extension)
                        - org.springframework.web.multipart.support.MultipartResolutionDelegate (Extension)
                            - org.springframework.web.method.annotation.ModelAttributeMethodProcessor$FieldAwareConstructorParameter (Extension)
                                - org.springframework.web.method.annotation.ModelAttributeMethodProcessor (Extension)
                                    - org.springframework.web.method.annotation.ModelFactory (Extension)
                                        - org.springframework.web.bind.support.WebExchangeDataBinder (Extension)
                                            - org.springframework.http.server.reactive.TomcatHttpHandlerAdapter$TomcatServerHttpRequest (Extension)
                                                - org.apache.catalina.connector.CoyoteInputStream (Extension)
                                                    - org.apache.catalina.connector.InputBuffer (Extension)
                                                        - org.apache.coyote.AbstractProtocol$RecycledProcessors (Extension)
                                                            - org.apache.coyote.AbstractProtocol (Extension)
                                                                - org.apache.tomcat.util.modeler.NoDescriptorRegistry (Extension)
                                                                    - org.apache.tomcat.util.modeler.NoDescriptorRegistry$PassthroughMBean (Extension)
                                                                        - org.apache.catalina.mbeans.NamingResourcesMBean (Extension)
                                                                            - org.apache.catalina.deploy.NamingResourcesImpl (Extension)
                                                                                - org.apache.catalina.startup.UserConfig (Extension)
                                                                                    -> ❌ org.apache.catalina.startup.Constants (Vulnerable Component)

Vulnerability Details

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.
Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: Jun 16, 2025 02:13 PM

URL: CVE-2025-48988

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🔴CVE-2025-48989

Vulnerable Library - tomcat-embed-core-9.0.55.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.apache.tomcat.embed/tomcat-embed-core/9.0.55/6ab68425d34f35e93cf97e1950c2c710161d8ce1/tomcat-embed-core-9.0.55.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)
    • spring-boot-starter-tomcat-2.6.1.jar
      • tomcat-embed-websocket-9.0.55.jar
        • ❌ tomcat-embed-core-9.0.55.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.autoconfigure.SpringBootApplication (Extension)
        - org.springframework.boot.autoconfigure.AutoConfigurationImportSelector (Extension)
            - org.springframework.boot.context.properties.bind.Binder (Extension)
                - org.springframework.boot.context.properties.bind.validation.ValidationBindHandler (Extension)
                    - org.springframework.boot.context.properties.bind.validation.ValidationBindHandler$ValidationResult (Extension)
                        - org.springframework.validation.BeanPropertyBindingResult (Extension)
                            - org.springframework.validation.DataBinder (Extension)
                                - org.springframework.validation.beanvalidation.LocalValidatorFactoryBean (Extension)
                                    - org.springframework.context.support.AbstractXmlApplicationContext (Extension)
                                        - org.springframework.beans.factory.support.DefaultListableBeanFactory (Extension)
                                            - org.springframework.beans.factory.annotation.QualifierAnnotationAutowireCandidateResolver (Extension)
                                                - org.springframework.test.web.servlet.setup.StubWebApplicationContext$StubBeanFactory (Extension)
                                                    - org.springframework.test.context.junit4.AbstractTransactionalJUnit4SpringContextTests (Extension)
                                                        - org.springframework.test.context.web.ServletTestExecutionListener (Extension)
                                                            - org.springframework.test.web.servlet.htmlunit.HtmlUnitRequestBuilder$HtmlUnitMockHttpServletRequest (Extension)
                                                                - org.springframework.test.web.servlet.htmlunit.HtmlUnitRequestBuilder (Extension)
                                                                    - org.springframework.test.web.servlet.htmlunit.MockMvcWebConnection (Extension)
                                                                        - org.springframework.test.web.servlet.client.MockMvcWebTestClient$1 (Extension)
                                                                            - org.springframework.test.web.servlet.client.MockMvcWebTestClient (Extension)
                                                                                - org.springframework.test.web.reactive.server.WebTestClient (Extension)
                                                                                    - org.springframework.test.web.reactive.server.DefaultRouterFunctionSpec (Extension)
                                                                                        - org.springframework.test.web.reactive.server.AbstractMockServerSpec (Extension)
                                                                                            - org.springframework.web.server.session.DefaultWebSessionManager (Extension)
                                                                                                - org.springframework.web.server.adapter.DefaultServerWebExchange (Extension)
                                                                                                    - org.springframework.http.server.reactive.TomcatHttpHandlerAdapter$TomcatServerHttpRequest (Extension)
                                                                                                        - org.apache.catalina.connector.CoyoteInputStream (Extension)
                                                                                                            - org.apache.catalina.connector.InputBuffer (Extension)
                                                                                                                - org.apache.coyote.AbstractProtocol$RecycledProcessors (Extension)
                                                                                                                    - org.apache.coyote.Processor (Extension)
                                                                                                                        - org.apache.tomcat.util.net.AprEndpoint (Extension)
                                                                                                                            - org.apache.catalina.mbeans.JmxRemoteLifecycleListener (Extension)
                                                                                                                                - org.apache.catalina.valves.rewrite.RewriteValve (Extension)
                                                                                                                                    -> ❌ org.apache.catalina.valves.rewrite.RewriteRule (Vulnerable Component)

Vulnerability Details

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.
Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

Publish Date: Aug 13, 2025 12:11 PM

URL: CVE-2025-48989

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🔴CVE-2025-52999

Vulnerable Library - jackson-core-2.13.0.jar

Core Jackson processing abstractions (aka Streaming API), implementation for JSON

Library home page: http://fasterxml.com/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-core/2.13.0/e957ec5442966e69cef543927bdc80e5426968bb/jackson-core-2.13.0.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)
    • spring-boot-starter-json-2.6.1.jar
      • jackson-databind-2.13.0.jar
        • ❌ jackson-core-2.13.0.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.SpringApplication (Extension)
        - org.springframework.boot.web.servlet.support.SpringBootServletInitializer$WebEnvironmentPropertySourceInitializer (Extension)
            - org.springframework.boot.web.servlet.support.SpringBootServletInitializer (Extension)
                - org.springframework.boot.context.logging.LoggingApplicationListener (Extension)
                    - org.springframework.boot.cloud.CloudFoundryVcapEnvironmentPostProcessor (Extension)
                        - org.springframework.boot.json.JsonParserFactory (Extension)
                            - org.springframework.boot.json.JacksonJsonParser (Extension)
                                - com.fasterxml.jackson.databind.ObjectMapper (Extension)
                                    -> ❌ com.fasterxml.jackson.core.util.ByteArrayBuilder (Vulnerable Component)

Vulnerability Details

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth is particularly large. jackson-core 2.15.0 contains a configurable limit for how deep Jackson will traverse in an input document, defaulting to an allowable depth of 1000. jackson-core will throw a StreamConstraintsException if the limit is reached. jackson-databind also benefits from this change because it uses jackson-core to parse JSON inputs. As a workaround, users should avoid parsing input files from untrusted sources.

Publish Date: Jun 25, 2025 05:02 PM

URL: CVE-2025-52999

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🔴CVE-2018-1271

Vulnerable Library - spring-core-5.3.13.jar

Spring Core

Library home page: https://spring.io/projects/spring-framework

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-core/5.3.13/d2a6c3372dd337e08144f9f49f386b8ec7a8080d/spring-core-5.3.13.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)

    • spring-webmvc-5.3.13.jar
      • spring-aop-5.3.13.jar
        • ❌ spring-core-5.3.13.jar (Vulnerable Library)

  • spring-boot-starter-test-2.6.1.jar (Root Library)

    • spring-boot-starter-2.6.1.jar
      • spring-boot-2.6.1.jar
        • ❌ spring-core-5.3.13.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.autoconfigure.SpringBootApplication (Extension)
        - org.springframework.boot.autoconfigure.AutoConfigurationImportSelector (Extension)
            - org.springframework.boot.context.properties.bind.Binder (Extension)
                - org.springframework.boot.context.properties.ConfigurationPropertiesBinder$ConfigurationPropertiesBindHandler (Extension)
                    - org.springframework.boot.context.properties.ConfigurationPropertiesBinder (Extension)
                        - org.springframework.validation.Validator (Extension)
                            - org.springframework.validation.AbstractBindingResult (Extension)
                                - org.springframework.validation.beanvalidation.SpringValidatorAdapter$ViolationFieldError (Extension)
                                    - org.springframework.validation.beanvalidation.LocalValidatorFactoryBean (Extension)
                                        - org.springframework.context.support.AbstractApplicationContext (Extension)
                                            - org.springframework.context.support.PostProcessorRegistrationDelegate (Extension)
                                                - org.springframework.context.annotation.ConfigurationClassParser$SourceClass (Extension)
                                                    - org.springframework.context.annotation.ConfigurationClassParser (Extension)
                                                        - org.springframework.context.annotation.ComponentScanAnnotationParser (Extension)
                                                            - org.springframework.context.annotation.TypeFilterUtils (Extension)
                                                                - org.springframework.core.type.filter.RegexPatternTypeFilter (Extension)
                                                                    -> ❌ org.springframework.core.type.filter.AbstractClassTestingTypeFilter (Vulnerable Component)

Vulnerability Details

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Publish Date: Apr 06, 2018 01:00 PM

URL: CVE-2018-1271

Threat Assessment

Exploit Maturity:Not Defined

EPSS:91.2%

Score: 8.2

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1271

Release Date: Apr 06, 2018 01:00 PM

Fix Resolution : org.springframework:spring-webflux:5.0.5.RELEASE,org.springframework:spring-webmvc:4.3.15.RELEASE,5.0.5.RELEASE

🔴CVE-2025-41242

Vulnerable Library - spring-webmvc-5.3.13.jar

Spring Web MVC

Library home page: https://spring.io/projects/spring-framework

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.springframework/spring-webmvc/5.3.13/cea31c85fa84dbd9f8df14a3ca62ab57c25cabe4/spring-webmvc-5.3.13.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.6.1.jar (Root Library)
    • ❌ spring-webmvc-5.3.13.jar (Vulnerable Library)

Reachability Analysis

This vulnerability is potentially reachable:

- fr.christophetd.log4shell.vulnerableapp.VulnerableAppApplication (Application)
    - org.springframework.boot.SpringApplication (Extension)
        - org.springframework.beans.factory.support.DefaultListableBeanFactory (Extension)
            - org.springframework.beans.factory.annotation.QualifierAnnotationAutowireCandidateResolver (Extension)
                - org.springframework.test.web.servlet.setup.StubWebApplicationContext$StubBeanFactory (Extension)
                    - org.springframework.test.context.testng.AbstractTestNGSpringContextTests (Extension)
                        - org.springframework.test.context.web.ServletTestExecutionListener (Extension)
                            - org.springframework.test.web.servlet.htmlunit.HtmlUnitRequestBuilder$HtmlUnitMockHttpServletRequest (Extension)
                                - org.springframework.test.web.servlet.htmlunit.HtmlUnitRequestBuilder (Extension)
                                    - org.springframework.test.web.servlet.htmlunit.MockMvcWebConnection (Extension)
                                        - org.springframework.test.web.servlet.client.MockMvcWebTestClient$1 (Extension)
                                            - org.springframework.test.web.servlet.client.MockMvcWebTestClient (Extension)
                                                - org.springframework.test.web.servlet.client.MockMvcWebTestClient$ControllerSpec (Extension)
                                                    - org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping (Extension)
                                                        - org.springframework.web.servlet.mvc.method.RequestMappingInfo (Extension)
                                                            - org.springframework.web.servlet.mvc.condition.ParamsRequestCondition (Extension)
                                                                -> ❌ org.springframework.web.servlet.mvc.condition.ParamsRequestCondition$ParamExpression (Vulnerable Component)

Vulnerability Details

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.
An application can be vulnerable when all the following are true:

Publish Date: Aug 18, 2025 08:47 AM

URL: CVE-2025-41242

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.2

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions