[GHSA-549f-4rpc-3rw9] Spring MVC and WebFlux applications that obtain a data...

[ranjiGT]

Updates

• Affected products
• Description
• References
• Source code location
• Summary

Comments

Reason for Change

This contribution improves the accuracy and completeness of
GHSA-549f-4rpc-3rw9 (CVE-2026-59281) by adding:

• The affected Maven package: org.springframework:spring-web.
• Affected version ranges across six Spring Framework release branches.
• Documented fixed versions and their availability.
• The upstream source repository.
• References to the upstream issue, security fix commits, and release.

Technical Details

The vulnerability originates in the spring-web module, specifically:

org.springframework.web.bind.EscapedErrors

The no-argument getFieldErrors() and getFieldError() methods previously
returned field errors without consistently applying HTML escaping.

The upstream fix updates these methods to use the existing escaping
helpers and introduces regression tests covering HTML escaping of
rejected values and error messages.

Upstream Verification

• Security advisory: https://spring.io/security/cve-2026-59281
• Upstream issue: Ensure consistent error escaping spring-projects/spring-framework#37055
• Fix commit: spring-projects/spring-framework@8cb1151
• Additional fix commit: spring-projects/spring-framework@ac0f8be
• Fixed open-source release: https://github.com/spring-projects/spring-framework/releases/tag/v7.0.9

Version Mapping

The affected version ranges follow the official Spring security advisory.

Spring Framework 7.0.9 is the documented open-source fixed release.
The fixes for older supported branches are designated
Enterprise Support Only by Spring.

The 5.2.x-and-earlier affected-product entry intentionally leaves the
patched Maven version unspecified because the exact enterprise artifact
version has not been independently verified.

Expected Improvement

These changes provide more complete package and version metadata
for vulnerability identification, dependency scanning, and
security advisory tracking.

[Copilot]

🟡 Changes recommended

Four enterprise-only versions are incorrectly used as public Maven fixed-version boundaries.

0 open findings

What changed in this PR

Improves GHSA-549f-4rpc-3rw9 with Spring Framework package, version, remediation, and source metadata.

Changes:

• Adds affected Maven ranges and fixed-version guidance.
• Adds upstream issue, commits, repository, and release references.
• Expands the summary and vulnerability details.

File	Description
advisories/​unreviewed/​2026/​08/​GHSA-549f-4rpc-3rw9/​GHSA-549f-4rpc-3rw9.json	Enriches the Spring Framework advisory metadata.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.