Skip to content

Broadcom/Spring August 2026 security advisory: 91 CVEs and the AI vulnerability-consumption gap

Summary

On August 20, 2026, Broadcom published a large collection of Spring security advisories affecting Spring Framework and related projects. Sonatype Research tracked 91 CVEs across the batch at time of publication, spanning Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch, with many individual advisories covering fixes across multiple supported version lines.

At the time Sonatype published its analysis (August 21, 2026), Sonatype Guide identified 209,569 affected software components, many of which are non-Spring components that bundle vulnerable Spring code. The disclosure includes insecure deserialization, untrusted code execution under certain conditions, exposure of sensitive information, SSRF, path traversal, denial of service, improper authorization, and other vulnerability classes.

Why this matters: the AI vulnerability-consumption problem

Sonatype frames this event as a concrete instance of a structural shift: AI-assisted vulnerability discovery is outpacing downstream remediation capacity.

  • Historical baseline: Spring historically received roughly 6.5 new security reports per month.
  • March 2026: that jumped to 55.
  • April 2026: Spring received 482 security reports across 65 scanned projects — including 370 produced by its own scanning capabilities and 112 submitted by the community.
  • June 2026: Broadcom described the June release as the largest set of Spring security updates in the project's 23-year history and reported a more than 1,700% increase in monthly Spring security advisories from March to April 2026.

The Spring engineering team has expanded its use of AI-assisted security analysis and frontier-model scanning in response. Sonatype notes that the Spring team has "done exactly what we want a maintainer to do: process the findings, produce fixes, and publish patched versions," but the question is how quickly those fixes propagate through the rest of the software supply chain.

Sonatype co-founder and CTO Brian Fox: "A fix existing upstream doesn't mean the vulnerability is remediated downstream. Other open source projects have to consume the new versions, enterprises have to understand where they're exposed, and applications ultimately have to be rebuilt and deployed with those fixes."

Sonatype has not confirmed that Anthropic's Mythos research specifically discovered the 91 CVEs in the August 20, 2026 event, but notes Spring has pointed to Mythos research as one example of how advanced AI models are uncovering vulnerabilities at much greater scale.

Standout vulnerabilities

CVE-2026-59285 — Spring for GraphQL unsafe deserialization → RCE (CVSS 9.2 Critical)

An unsafe deserialization vulnerability in Spring for GraphQL. Sonatype Research found that affected applications may be exploitable when they:

  1. Use Jackson 2.x for JSON deserialization,
  2. Expose paginated GraphQL fields, and
  3. Include certain classes that can be abused during deserialization.

Sonatype rates it 9.2 Critical and recommends upgrading to a non-vulnerable version. If Spring GraphQL is included transitively and no direct upgrade path exists, teams may need to update the parent dependency, contact its maintainer, or apply mitigating controls.

CVE-2026-59318 — Spring AI tool-calling request-boundary bypass

Affects Spring AI's tool-calling functionality. Under certain conditions, a prompt-injection attack could cause Spring AI to invoke a tool that was not made available to the current request, potentially allowing privilege escalation. Spring rates it Medium severity.

This reflects a broader concern Sonatype Research Labs highlighted after Black Hat 2026: telling an AI agent what it should or should not do is not the same as enforcing what it is actually allowed to do. If an attacker can manipulate the model while the underlying system still permits access to a tool or action, prompt-level restrictions may not be enough.

September 3, 2026 follow-up: when "Critical" loses context (JFrog)

JFrog Security Research published "When 'Critical' Loses Context: The Reality of Spring CVEs" on September 3, 2026, a triage analysis of this exact batch. The load-bearing finding for defenders: CISA's Automated Prioritization (ADP) engine rated six of these Spring CVEs "Critical" on August 20, but the underlying CVSS scores do not survive contact with the actual exploit conditions, and the divergence between the CISA/ADP score and the vendor (Spring) score is large:

CVE Component CISA/ADP Spring JFrog read
CVE-2026-47884 spring-webmvc 9.8 5.8 Conditional RCE via the legacy XsltView path; only ~33 GitHub imports in scope. Reachable but narrow.
CVE-2026-47890 spring-webmvc / webflux 9.8 2.6 SSE stream corruption via a \r byte; no code execution or data leak.
CVE-2026-47891 spring-web 9.8 4.3 Memory-exhaustion (DoS) only.
CVE-2026-47892 spring-webflux 9.8 4.8 Exploitable only under non-default configuration conditions.
CVE-2026-59313 spring-webmvc 9.8 2.6 Same SSE-stream bug as CVE-2026-47890 (duplicate surface).
CVE-2026-59283 spring-expression 9.1 6.5 Higher but still below the ADP "Critical" framing.

Durable read: ADP is a risk-prioritization signal, not a proof of exploitability. A batch of nine-or-ten-point scores on a framework that is not in KEV, not on a federal-critical list, and not in the EO 14028 critical set is a triage trigger, not an emergency. JFrog's per-CVE re-derivation shows five of the six "Critical" ADP items are actually low-to-medium in real-world reachability. Do not let the ADP band drive blanket emergency patching of the whole 91-CVE set; instead, weight by (a) whether the component is actually deployed, (b) the real exploit preconditions (default vs non-default config, legacy code paths), and (c) whether any KEV listing materializes.

Why the scores drifted in the first place

The divergence is a structural artifact, not a Spring scoring error: - NIST stopped enriching all CVEs in April 2026. CVEs that are not in KEV, not federal-critical, and not EO 14028-critical no longer receive NIST enrichment — which is exactly where Spring's batch landed. - The NVD backlog was already over 27,000 CVEs at the time, so scoring quality on non-priority items degraded. - 2026 YTD CVE volume was 58,482, up +45% vs 2024 (40,313) and +20.9% vs 2025 (48,364) — the per-CVE analysis investment that used to keep scores honest is no longer being applied at the volume the ecosystem now produces.

Defender heuristics: For the ADP-"Critical" Spring items, default to patch in the normal cycle, verify the real preconditions, not drop everything and patch the batch now — unless you expose the specific affected endpoint (e.g., legacy XsltView rendering, paginated GraphQL with Jackson 2.x, or SSE streaming) and run a configuration the CVE actually reaches. Watch CISA KEV for any of the six; a KEV addition would change the risk model entirely.

Affected projects

  • Spring Security
  • Spring Cloud Config
  • Spring AI
  • Spring Data REST
  • Spring Integration
  • Reactor Core
  • Reactor Netty
  • Spring AMQP
  • Spring Batch

Many individual advisories also include fixes across multiple supported version lines, making the downstream impact considerably larger than the CVE count alone might suggest.

Defender priorities

  • Inventory Spring exposure: determine which applications contain affected Spring components, which vulnerable versions are actually deployed, whether dependencies are direct or transitive, and which upgrades remediate issues without introducing unnecessary disruption.
  • Prioritize by actual exposure and exploitability, not severity scores alone.
  • Plan for recurring large-batch disclosures: as AI-assisted research scales, large vulnerability disclosure events will become increasingly common. Vulnerability intelligence and remediation pipelines need to move toward machine speed.
  • Spring AI / agent tool-calling: if you use Spring AI's tool-calling, treat prompt-level restrictions as insufficient security controls. Enforce tool availability at the system/runtime level, not just in the model's instructions. Review and upgrade to the fixed Spring AI release.
  • Spring GraphQL / Jackson deserialization: if you expose paginated GraphQL fields with Jackson 2.x, verify the affected version range for CVE-2026-59285 and patch or apply mitigating controls.
  • Watch for KEV additions: none of the 91 CVEs were in CISA KEV at scan time; monitor for additions, especially CVE-2026-59285 (deserialization RCE, CVSS 9.2).

Tags

Sources