Skip to content

Broadcom/Spring August 2026 security advisory: 91 CVEs and the AI vulnerability-consumption gap

Summary

On August 20, 2026, Broadcom published a large collection of Spring security advisories affecting Spring Framework and related projects. Sonatype Research tracked 91 CVEs across the batch at time of publication, spanning Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, and Spring Batch, with many individual advisories covering fixes across multiple supported version lines.

At the time Sonatype published its analysis (August 21, 2026), Sonatype Guide identified 209,569 affected software components, many of which are non-Spring components that bundle vulnerable Spring code. The disclosure includes insecure deserialization, untrusted code execution under certain conditions, exposure of sensitive information, SSRF, path traversal, denial of service, improper authorization, and other vulnerability classes.

Why this matters: the AI vulnerability-consumption problem

Sonatype frames this event as a concrete instance of a structural shift: AI-assisted vulnerability discovery is outpacing downstream remediation capacity.

  • Historical baseline: Spring historically received roughly 6.5 new security reports per month.
  • March 2026: that jumped to 55.
  • April 2026: Spring received 482 security reports across 65 scanned projects — including 370 produced by its own scanning capabilities and 112 submitted by the community.
  • June 2026: Broadcom described the June release as the largest set of Spring security updates in the project's 23-year history and reported a more than 1,700% increase in monthly Spring security advisories from March to April 2026.

The Spring engineering team has expanded its use of AI-assisted security analysis and frontier-model scanning in response. Sonatype notes that the Spring team has "done exactly what we want a maintainer to do: process the findings, produce fixes, and publish patched versions," but the question is how quickly those fixes propagate through the rest of the software supply chain.

Sonatype co-founder and CTO Brian Fox: "A fix existing upstream doesn't mean the vulnerability is remediated downstream. Other open source projects have to consume the new versions, enterprises have to understand where they're exposed, and applications ultimately have to be rebuilt and deployed with those fixes."

Sonatype has not confirmed that Anthropic's Mythos research specifically discovered the 91 CVEs in the August 20, 2026 event, but notes Spring has pointed to Mythos research as one example of how advanced AI models are uncovering vulnerabilities at much greater scale.

Standout vulnerabilities

CVE-2026-59285 — Spring for GraphQL unsafe deserialization → RCE (CVSS 9.2 Critical)

An unsafe deserialization vulnerability in Spring for GraphQL. Sonatype Research found that affected applications may be exploitable when they:

  1. Use Jackson 2.x for JSON deserialization,
  2. Expose paginated GraphQL fields, and
  3. Include certain classes that can be abused during deserialization.

Sonatype rates it 9.2 Critical and recommends upgrading to a non-vulnerable version. If Spring GraphQL is included transitively and no direct upgrade path exists, teams may need to update the parent dependency, contact its maintainer, or apply mitigating controls.

CVE-2026-59318 — Spring AI tool-calling request-boundary bypass

Affects Spring AI's tool-calling functionality. Under certain conditions, a prompt-injection attack could cause Spring AI to invoke a tool that was not made available to the current request, potentially allowing privilege escalation. Spring rates it Medium severity.

This reflects a broader concern Sonatype Research Labs highlighted after Black Hat 2026: telling an AI agent what it should or should not do is not the same as enforcing what it is actually allowed to do. If an attacker can manipulate the model while the underlying system still permits access to a tool or action, prompt-level restrictions may not be enough.

Affected projects

  • Spring Security
  • Spring Cloud Config
  • Spring AI
  • Spring Data REST
  • Spring Integration
  • Reactor Core
  • Reactor Netty
  • Spring AMQP
  • Spring Batch

Many individual advisories also include fixes across multiple supported version lines, making the downstream impact considerably larger than the CVE count alone might suggest.

Defender priorities

  • Inventory Spring exposure: determine which applications contain affected Spring components, which vulnerable versions are actually deployed, whether dependencies are direct or transitive, and which upgrades remediate issues without introducing unnecessary disruption.
  • Prioritize by actual exposure and exploitability, not severity scores alone.
  • Plan for recurring large-batch disclosures: as AI-assisted research scales, large vulnerability disclosure events will become increasingly common. Vulnerability intelligence and remediation pipelines need to move toward machine speed.
  • Spring AI / agent tool-calling: if you use Spring AI's tool-calling, treat prompt-level restrictions as insufficient security controls. Enforce tool availability at the system/runtime level, not just in the model's instructions. Review and upgrade to the fixed Spring AI release.
  • Spring GraphQL / Jackson deserialization: if you expose paginated GraphQL fields with Jackson 2.x, verify the affected version range for CVE-2026-59285 and patch or apply mitigating controls.
  • Watch for KEV additions: none of the 91 CVEs were in CISA KEV at scan time; monitor for additions, especially CVE-2026-59285 (deserialization RCE, CVSS 9.2).

Tags

Sources