Broadcom has disclosed 91 Common Vulnerabilities and Exposures (CVEs) affecting the Spring Framework and related projects, triggering a software supply chain remediation event that Sonatype estimates impacts 209,569 software components.
The advisory issued on August 20 highlights the widening gap between AI-accelerated vulnerability discovery and organizations’ ability to identify, fix, rebuild, and deploy affected software.
91 Spring CVEs Impact Software Components
The advisories address several Spring projects, including Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch.
The reported flaw classes include insecure deserialization, untrusted code execution, exposure of sensitive information, server-side request forgery, path traversal, denial-of-service, and improper authorization.
The sheer number of CVEs does not fully reflect the total exposure. A vulnerable Spring library can affect an application directly, through a framework starter, or transitively via another open-source project.
Sonatype’s figure of affected components also includes non-Spring packages that bundle vulnerable Spring code. Thus, an upstream patch does not complete the remediation process; downstream projects must adopt it, enterprises must locate it within their inventories, and affected applications must be rebuilt and redeployed.
Notably, CVE-2026-59285 identifies an unsafe deserialization issue in Spring for GraphQL. It has been assigned a CVSS score of 9.2, rated as Critical.
This vulnerability may be exploited if an application uses Jackson 2.x for JSON deserialization, exposes paginated GraphQL fields, and includes classes that could be attacked within a deserialization chain.
Teams should upgrade to a fixed version of Spring GraphQL; if the vulnerability is transitive, it may require upgrading the parent dependency or obtaining a maintainer update.
Additionally, the release includes CVE-2026-59318, a Medium-severity flaw regarding Spring AI tool calls. Under certain conditions, prompt injection could cause Spring AI to invoke a tool not available for the current request, potentially crossing request boundaries and leading to privilege escalation.
This issue underscores an important principle in agentic AI security: prompts cannot replace authorization controls. Tool access must be enforced within application and identity layers, rather than described to the model.
The volume of Spring advisories had already surged in 2026. Broadcom previously reported an increase of more than 1,700% in monthly Spring advisories between March and April.
In March alone, Spring received 55 security reports, and 482 were received across 65 scanned projects in April. These findings included results from internally generated AI-assisted scans and community submissions; however, Sonatype did not attribute the August CVEs to any specific AI system.
Organizations should immediately assess which affected Spring versions are present across production environments, development systems, and artifact repositories.
Security teams should prioritize protecting internet-facing services, GraphQL deployments, applications that expose AI tools, and packages that contain accessible, vulnerable code. Software Bill of Materials (SBOMs) and dependency-resolution data can assist in identifying both direct and transitive exposures.
Additionally, upgrade testing should confirm compatibility across supported Spring version lines. As AI accelerates vulnerability discovery, component intelligence and remediation automation are becoming crucial defenses in the software supply chain.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
