Spring Patches 8 Vulnerabilities Including Critical Arbitrary Code Execution Flaw
Summary
ACN issued an alert (AL02/260424/CSIRT-ITA) disclosing 8 security vulnerabilities in Spring, the open-source Java enterprise framework. Among them are one critical-severity and two high-severity flaws affecting Spring Boot versions 2.7.x through 4.0.x, including end-of-life versions no longer supported. The critical vulnerability permits arbitrary code execution without authentication (CVSS score estimated 9.8). ACN recommends updating affected installations to patched versions per the vendor security bulletins.
“Aggiornamenti di sicurezza risolvono 8 vulnerabilità, tra cui una con gravità "critica" e due "alta", in Spring, noto framework open‑source per lo sviluppo di applicazioni Java, usato in ambito enterprise.”
Organizations running Spring Boot should immediately audit their environments against the affected version ranges — particularly versions 2.7.x through 3.3.x, which are likely most prevalent in production. The critical arbitrary code execution flaw (CVE-2026-40976) requires no authentication to exploit, making unpatched internet-facing Spring applications the highest-priority remediation target.
About this source
GovPing monitors Italy ACN News alt for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 7 changes logged to date.
What changed
ACN published an alert covering 8 resolved vulnerabilities in Spring, the open-source Java framework widely used in enterprise applications. One vulnerability is rated critical (arbitrary code execution) and two are rated high severity. Affected versions include Spring Boot 2.7.x (up to 2.7.32), 3.3.x (up to 3.3.18), 3.4.x (up to 3.4.15), 3.5.x (up to 3.5.13), and 4.0.x (up to 4.0.5), plus all prior end-of-life versions. CVEs cited include CVE-2026-40976, CVE-2026-40972, and CVE-2026-40973.
Organizations running Spring-based applications should identify affected Spring Boot versions in their environments and apply updates immediately. The critical arbitrary code execution flaw poses the highest risk and should be prioritized. No specific compliance deadline is stated in the alert; remediation is on a best-efforts basis per vendor guidance.
What to do next
- Update vulnerable Spring products to patched versions per vendor security bulletins
- Contact ACN or refer to Spring.io security references for remediation guidance
Archived snapshot
Apr 24, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Risolte vulnerabilità in Spring
**
Alert**
AL02/260424/CSIRT-ITA
Condividi
- Facebook
- Twitter
- LinkedIn
- Whatsapp
Sintesi
Aggiornamenti di sicurezza risolvono 8 vulnerabilità, tra cui una con gravità “critica” e due “alta”, in Spring, noto framework open‑source per lo sviluppo di applicazioni Java, usato in ambito enterprise.
Tipologia
- Arbitrary Code Execution
- Authentication Bypass
- Information Disclosure
- Privilege Escalation
Prodotti e/o versioni affette
Spring Boot
- 4.0.x: versioni dalla 4.0.0 alla 4.0.5
- 3.5.x: versioni dalla 3.5.0 alla 3.5.13
- 3.4.x: versioni dalla 3.4.0 alla 3.4.15
- 3.3.x: versioni dalla 3.3.0 alla 3.3.18
- 2.7.x: versioni dalla 2.7.0 alla 2.7.32
- tutte le versioni precedenti non più supportate (EOL).
Azioni di mitigazione
In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.
Di seguito sono riportate le sole CVE relative alle vulnerabilità con gravità “critica” e “alta”:
CVE (3)
Cerca:
| CVE | POC | EXPLOITATION |
| --- | --- | --- |
| CVE-2026-40976 | - | - |
| CVE-2026-40972 | - | - |
| CVE-2026-40973 | - | - |
Riferimenti (4)
- https://spring.io/security/cve-2026-40976
- https://spring.io/security/cve-2026-40972
- https://spring.io/security/cve-2026-40973
- https://spring.io/security
Change log
| Versione | Note | Data |
|---|---|---|
| 1.0 | Pubblicato il 24-04-2026 | 24/04/2026 |
Impatto sistemico
Alto (65.51)
Argomenti
Data pubblicazione
24/04/26 ore 11:38
Data Ultimo Aggiornamento
24/04/26 ore 11:38
Parties
Related changes
Get daily alerts for Italy ACN News alt
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from ACN.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when Italy ACN News alt publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.