Reported by 2 outlets
91 Spring CVEs Impact Over 209,000 Software Components Across the Supply Chain
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.30 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
91 Spring CVEs Impact Over 209,000 Software Components Across the Supply Chain
gbhackers.com · 49d ago · August 25th, 2026
Broadcom has disclosed 91 Common Vulnerabilities and Exposures (CVEs) affecting the Spring Framework and related projects, triggering a software supply chain remediation event that Sonatype estimates impacts 209,569 software components. The advisory issued on August 20 highlights the widening gap between AI-accelerated vulnerability discovery and organizations’ ability to identify, fix, rebuild, and deploy affected software. […] The post 91 Spring CVEs Impact Over 209,000 Software Components Across the Supply Chain appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Critical Spring GraphQL Deserialization Flaw Enables Remote Code Execution
cyberpress.org · 49d ago · August 25th, 2026
A critical unsafe deserialization vulnerability in Spring for GraphQL, tracked as CVE-2026-59285, could enable remote code execution in affected applications under specific conditions. Sonatype assigned CVE-2026-59285 a CVSS score of 9.2, placing it in the Critical severity range. The issue affects applications using Spring for GraphQL with Jackson 2.x for JSON deserialization, paginated GraphQL fields, and certain classes that can be abused during deserialization. Critical Spring GraphQL Deserialization Flaw Unsafe deserialization occurs when an application accepts serialized data from an untrusted source and reconstructs it into objects without sufficiently restricting which types may be created. In vulnerable environments, an attacker may be able to craft malicious input that causes the application to instantiate an unintended class or execute attacker-controlled code. The vulnerability does not automatically affect every application that includes Spring for GraphQL. Exploitation depends on the application’s GraphQL implementation, the presence of paginated fields, Jackson 2.x deserialization behavior, and the availability of suitable classes on the classpath. However, the combination is concerning because GraphQL endpoints are often externally accessible and designed to process structured user-supplied requests. Organizations should not