91 Spring Vulnerabilities Impact 209,000+ Software Components Across Open-Source Ecosystem

Broadcom has released a major batch of Spring security advisories, with Sonatype tracking 91 CVEs across Spring Framework and related projects.

The August 20, 2026 disclosure affects an estimated 209,569 software components, highlighting the growing downstream impact of open-source vulnerabilities.

The advisories cover widely used projects including Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch.

Spring’s advisory portal lists fixes across several supported version lines, meaning organizations may need to upgrade more than one branch of the same product.

The disclosed flaws include insecure deserialization, potential execution of untrusted code, information disclosure, server-side request forgery, path traversal, denial-of-service, and authorization weaknesses.

91 Spring Vulnerabilities Impact

While each issue has different prerequisites and impact, the number of affected packages makes dependency discovery and remediation a major challenge.

The scale of the event extends beyond applications that directly import Spring libraries. Many affected components are likely to include vulnerable Spring code as transitive dependencies, embedded libraries, or dependencies used by upstream frameworks.

The availability of a patched version upstream does not automatically protect an enterprise application. Maintainers must adopt the update, development teams must rebuild their software, and organizations must deploy the resulting fixed release.

One high-impact issue identified in the release is CVE-2026-59285, an unsafe deserialization flaw affecting Spring for GraphQL. Sonatype rated the vulnerability 9.2 Critical.

The issue may be exploitable when an application uses Jackson 2.x for JSON deserialization, exposes paginated GraphQL fields, and exposes potentially dangerous classes during deserialization.

Under those conditions, an attacker could potentially achieve remote code execution. Another notable flaw is CVE-2026-59318, which affects Spring AI tool-calling functionality.

The vulnerability may allow a prompt-injection attack to trigger a tool that was not intended to be available to a particular request. This could create a path toward privilege escalation in AI-enabled applications if tool permissions are not enforced at the underlying system layer.

The Spring event arrives during a sharp rise in AI-assisted security research. Sonatype reported that newly affected component versions increased at 46 times the pre-AI rate.

In contrast, critical and high-severity vulnerabilities per enterprise application increased by a factor of 4.31 over its four-year analysis.

Spring itself has already seen a surge in vulnerability reporting. Broadcom previously said monthly Spring security advisories rose by more than 1,700% from March to April 2026.

The increase reflects both improved security research and the ability of AI systems to identify potential weaknesses across large codebases at machine speed.

According to Sonatype research, defenders should prioritize identifying vulnerable Spring versions in production, checking direct or transitive dependencies, and assessing exposure based on reachable attack paths rather than immediately patching all 91 CVEs.

Internet-facing services, GraphQL deployments, Spring AI implementations, and applications handling untrusted data should receive immediate attention.

Organizations should review the Spring advisories, update to the listed fixed versions, scan software bills of materials, and validate upgrades through testing.

As AI accelerates vulnerability discovery, software supply chain teams will need equally fast methods for dependency intelligence, prioritization, and secure remediation.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post 91 Spring Vulnerabilities Impact 209,000+ Software Components Across Open-Source Ecosystem appeared first on Cyber Security News.