SPRING has issued an update that fixes 91 vulnerabilities in its application framework, the most serious of which is a critical LDAP flaw tracked as CVE-2026-59270. The flaw affects the embedded LDAP server used by Spring Security and could allow an attacker to read or modify directory information without authentication.
According to the advisory published by VMware, CVE-2026-59270 carries a CVSS score of 9.4 and impacts Spring Security releases from the 5.7.x line through to version 7.1.0. Successful exploitation requires no special privileges and can be performed over the network by crafting a malicious LDAP request that the server processes as legitimate.
The same update also addresses CVE-2026-59285, a critical remote code execution vulnerability, and CVE-2026-59318, a medium‑severity privilege escalation issue. While no public exploits have been observed for these flaws, researchers at Sonatype estimate that more than 200,000 open‑source components depend on the affected Spring modules.
This patch release is part of a broader effort by Broadcom’s Spring team to resolve over 200 security issues reported in the framework so far this year. The vulnerabilities span multiple modules including Spring Security, Spring AI and various OAuth related components, highlighting the wide attack surface presented by the framework’s extensive feature set.
Defenders should upgrade to the patched releases immediately. For Spring Security this means moving to version 7.1.1, 7.0.7 or the appropriate 6.x and 5.x builds as indicated in the vendor’s advisory. In addition, organisations can limit exposure by restricting network access to the LDAP service and reviewing directory permissions for unnecessary privileges.
Administrators are also advised to audit logs for anomalous LDAP queries and to employ dependency‑checking tools that flag vulnerable versions in build pipelines. Applying the updates through standard Maven or Gradle workflows will ensure that transitive dependencies receive the fixed code as well.