Clement Brako Akomea Table of Contents
On August 20, 2026, Broadcom disclosed 91 Spring CVEs across Spring Framework and related projects, one of the largest single security events the ecosystem has recorded. A CVE, or Common Vulnerabilities and Exposures entry, is a public catalog ID for a specific software flaw.
Sonatype, which tracked the batch, says 209,569 software components are affected: a figure that dwarfs the raw count because so many non-Spring components bundle vulnerable Spring code.
The disclosure lands amid a sharp, AI-driven rise in vulnerability discovery that is testing whether organizations can remediate as fast as machines can find flaws.
Spring CVEs: Key Takeaway
- AI is surfacing Spring CVEs faster than teams can patch, and the August batch of 91 flaws shows remediation, not discovery. is now the real bottleneck.
This section contains affiliate links; we may earn a commission at no cost to you.
A disclosure this size is only manageable if you can see and rank your exposure quickly. These tools help:
- Tenable — When 91 CVEs land at once, you need to know which of your assets are actually exposed. Tenable’s vulnerability management ranks real-world risk so you patch what matters first.
- Auvik — You can’t remediate what you can’t see. Auvik maps and monitors your network so vulnerable, internet-facing components don’t stay hidden.
- CyberUpgrade — Turn a chaotic disclosure into a managed process. CyberUpgrade coordinates remediation, compliance, and reporting so nothing slips through.
What Broadcom Disclosed on August 20
Broadcom, which stewards the Spring portfolio, published a large collection of security advisories affecting Spring and related open source projects. Sonatype’s research team counted 91 individual CVEs in the release.
The scale alone made the event stand out. The advisories cover a broad mix of weakness types rather than a single class of bug, which widens the range of applications that could be at risk.
The vulnerability classes involved
The disclosure spans insecure deserialization, untrusted code execution under specific conditions, exposure of sensitive information, server-side request forgery, path traversal, denial of service, and improper authorization. Server-side request forgery, or SSRF, tricks a server into making requests an attacker controls, often reaching internal systems.
Several of the issues are rated high severity. Because the affected code is embedded so widely, even medium-rated flaws can matter once they are multiplied across thousands of downstream applications.
Affected Spring projects
The August advisory reaches across the ecosystem, including Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch. Many advisories also ship fixes across several supported version lines at once.
That breadth is part of why the remediation task is so large. A single organization may run half a dozen of these projects across different services, each on a different version.
Why 91 Spring CVEs Create a Bigger Remediation Problem
The headline number understates the work involved. At publication, Sonatype Guide identified 209,569 affected components, many of them non-Spring packages that bundle vulnerable Spring code as a dependency.
That is the crux of the software supply chain problem: a flaw in one widely used library ripples outward into everything built on top of it. Modern applications inherit risk they never explicitly chose, echoing the way a single compromised package can cascade through an ecosystem, as seen in past supply chain attacks on open source registries.
Sonatype co-founder and chief technology officer Brian Fox framed publishing a fix as only the starting line. He credited the Spring team for doing what maintainers should, triaging the findings, building fixes, and shipping patched releases. and said the open question is how fast those patches move through the rest of the supply chain.
An upstream fix, Fox noted, “doesn’t mean the vulnerability is remediated downstream.” Other open source projects have to adopt the new versions, enterprises have to map where they are exposed, and applications ultimately have to be rebuilt and redeployed before the risk actually closes.
For development and security teams, a single disclosure turns into a long list of questions: which applications contain the affected components, which vulnerable versions are actually deployed, whether those dependencies are direct or pulled in transitively, which flaws carry the most real risk, and which upgrades fix the problem without breaking something else. A transitive dependency is one your code never imports directly: it arrives because another library depends on it.
Those decisions only get harder as disclosures grow in both volume and frequency.
An AI-Driven Vulnerability Surge Was Already Underway
The August event was not the first oversized Spring release of the year. It fits a pattern that began building months earlier.
In June 2026, Broadcom reported that Spring had seen an increase of more than 1,700% in monthly security advisories between March and April 2026. The company called its June release the largest set of Spring security updates in the project’s 23-year history.
The raw report volume tells the same story. Historically, Spring received roughly 6.5 new security reports per month. In March 2026, that number jumped to 55. In April, Spring logged 482 security reports across 65 scanned projects — 370 produced by its own scanning capabilities and another 112 submitted by the community.
The surge pushed the Spring engineering team to expand its use of AI-assisted security analysis and frontier-model scanning. In other words, AI is now on both sides of the equation: finding flaws faster and forcing defenders to keep up.
Spring has pointed to Anthropic’s Mythos research as one example of how advanced AI models are uncovering vulnerabilities at far greater scale. Sonatype, however, has not confirmed that Mythos specifically discovered the 91 CVEs in the August 20 event, an important distinction, and one the source is careful to make.
CVE-2026-59285: Unsafe Deserialization Enables Remote Code Execution
One flaw in the August batch stands out for severity and impact: CVE-2026-59285, an unsafe deserialization vulnerability in Spring for GraphQL. Deserialization is the process of rebuilding program objects from stored or transmitted data; when it is not properly constrained, attackers can smuggle in objects that trigger malicious behavior.
Sonatype Research found that affected applications may be exploitable when they use Jackson 2.x for JSON deserialization, expose paginated GraphQL fields, and include certain classes that can be abused during the deserialization step. When those conditions line up, the flaw can open a path to remote code execution, the ability to run attacker-supplied commands on the server. Similar deserialization chains have driven critical remote code execution flaws in other widely used Java libraries.
Sonatype assigns the vulnerability a CVSS score of 9.2, rated Critical. CVSS, the Common Vulnerability Scoring System, rates severity from 0 to 10, so 9.2 sits near the top of the scale.
The recommended action is to upgrade to a non-vulnerable version. Where Spring GraphQL is present only transitively and no direct upgrade path exists, teams may need to update the parent dependency, contact its maintainer, or apply mitigating controls in the meantime.
CVE-2026-59318: Prompt Injection in Spring AI Tool Calling
A second notable issue, CVE-2026-59318, affects the tool-calling functionality in Spring AI. Tool calling is what lets an AI application take actions, querying a database, hitting an API, rather than just generating text.
Under certain conditions, a prompt-injection attack could cause Spring AI to invoke a tool that was not meant to be available to the current request, potentially enabling privilege escalation. Prompt injection manipulates the text fed to an AI model so it behaves against the operator’s intent. Spring rates this flaw Medium severity.
Sonatype Research Labs tied the bug to a broader theme it raised at Black Hat 2026: telling an AI agent what it should or should not do is not the same as enforcing what it is actually permitted to do. If an attacker can steer the model while the underlying system still allows access to a tool or action, instructions written into a prompt may not hold.
Spring recommends upgrading affected Spring AI versions to a fixed release.
What Organizations Using Spring Should Do
Teams should start by reviewing the August advisories and checking whether affected versions are present across applications, development environments, and internal software repositories. Shadow copies in build systems and artifact caches are easy to overlook.
From there, prioritize by actual application exposure and exploitability rather than severity scores alone, then move affected components to appropriate fixed versions. A Critical rating on a component you don’t deploy matters less than a Medium flaw sitting on an internet-facing service.
More broadly, organizations should treat large disclosures as the new normal and build the intake and triage muscle to absorb them. As vulnerability discovery moves toward machine speed, vulnerability intelligence and remediation have to follow.
Implications of AI-Accelerated Vulnerability Discovery
The Spring event is less a one-off crisis than a preview of how security work changes when AI drives discovery. The consequences show up across several dimensions.
The remediation gap widens
AI compresses the time it takes to find flaws, but it does nothing to compress the time it takes to fix them. Adopting a patched version, rebuilding applications, testing, and redeploying still moves at human and organizational speed. As discovery accelerates and remediation stays roughly constant, the gap between “known” and “fixed” grows, and that window is exactly where attackers operate.
Transitive dependencies multiply the blast radius
The 209,569 affected components underline how little the CVE count reveals about real exposure. Most of that risk lives in packages that merely bundle vulnerable Spring code.
Organizations that track only their direct dependencies will badly undercount their exposure. Accurate software bills of materials and dependency graphs become the difference between a targeted fix and a blind guess.
Instruction is not enforcement for AI systems
The Spring AI tool-calling flaw crystallizes a lesson that will recur as AI features spread into mainstream frameworks. Guardrails expressed as prompts are advisory, not architectural.
Real security has to be enforced at the layer that grants access to tools, data, and actions, not at the layer that politely asks the model to behave. Expect prompt-injection-class issues to become a standard category in vulnerability disclosures.
Prioritization becomes the core security skill
When a single advisory carries dozens of CVEs, patching everything at once is rarely feasible. The teams that cope best will be the ones that can rank flaws by real exploitability and business exposure within hours, not weeks. Severity scores are an input to that decision, not the decision itself. Tooling that connects a CVE to the specific deployed application it threatens is what turns a scary number into an action plan.
This section contains affiliate links; we may earn a commission at no cost to you.
Closing the gap between discovery and remediation takes process and prioritization. These can help:
- Plesk — Keep the servers hosting your Spring apps patched and hardened. Plesk centralizes updates and security management across your hosting stack.
- Tenable — Prioritize by exploitability, not just CVSS. Tenable continuously surfaces the vulnerabilities most likely to be attacked in your specific environment.
Looking Forward
The 91 Spring CVEs are significant on their own, but the more durable story is what they reveal about direction. AI has already reshaped the discovery side of security, and the volume and cadence of disclosures are unlikely to fall back to old baselines.
For defenders, that shifts the center of gravity from finding flaws to fixing them fast. Mapping exposure, ranking risk by real deployment and exploitability, and moving to fixed versions without needless disruption are now the decisive capabilities.
The Spring team did its part by triaging, patching, and publishing. Whether the wider ecosystem keeps pace will depend on how quickly enterprises can turn a disclosure into deployed, remediated code, before machine-speed discovery becomes machine-speed exploitation.
Questions Worth Answering
How many Spring CVEs were disclosed and when?
- Broadcom published the advisories on August 20, 2026, and Sonatype tracked 91 CVEs across Spring Framework and related projects.
How many components are affected?
- Sonatype Guide identified 209,569 affected components, many of them non-Spring packages that bundle vulnerable Spring code as a dependency.
Which Spring projects are involved?
- The advisory reaches Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch, often across multiple version lines.
What is the most severe vulnerability in the batch?
- CVE-2026-59285, an unsafe deserialization flaw in Spring for GraphQL, which Sonatype rates 9.2 Critical on the CVSS scale and which can lead to remote code execution.
What conditions make CVE-2026-59285 exploitable?
- Sonatype Research found affected apps may be exploitable when they use Jackson 2.x for JSON deserialization, expose paginated GraphQL fields, and include certain classes abusable during deserialization.
What is the Spring AI vulnerability about?
- CVE-2026-59318 lets a prompt-injection attack make Spring AI invoke a tool not meant for the current request, potentially enabling privilege escalation; Spring rates it Medium severity.
Why does a fix upstream not end the problem?
- As Sonatype’s Brian Fox notes, downstream projects must adopt the patched versions, enterprises must map their exposure, and applications must be rebuilt and redeployed before the risk actually closes.
What role is AI playing in this surge?
- Broadcom reported a more than 1,700% rise in monthly Spring advisories from March to April 2026, driven largely by AI-assisted vulnerability discovery and expanded frontier-model scanning.
Did AI discover these 91 CVEs specifically?
- Spring has cited Anthropic’s Mythos research as an example of AI-scale discovery, but Sonatype has not confirmed that Mythos found the 91 CVEs in the August 20 event.
What should organizations do first?
- Review the August advisories, locate affected versions across apps, dev environments, and repositories, then prioritize by real exposure and exploitability before upgrading to fixed versions.
This section contains affiliate links; we may earn a commission at no cost to you.
Also worth a look: lock down logins with 1Password, keep recoverable backups with IDrive, and stop email spoofing with EasyDMARC — three simple ways to harden your stack.
Primary source: Sonatype — 91 Spring CVEs Highlight the Growing AI Vulnerability Consumption Problem. Additional references: Spring Security Advisories, Sonatype Guide: CVE-2026-59285, and CVE-2026-59318.
