Skip to content

fix(#1318): fixing security findings in backend - #1320

Merged
paulushcgcj merged 1 commit into
mainfrom
fix/sec-issues-backend-20260528
May 28, 2026
Merged

fix(#1318): fixing security findings in backend#1320
paulushcgcj merged 1 commit into
mainfrom
fix/sec-issues-backend-20260528

Conversation

@paulushcgcj

@paulushcgcj paulushcgcj commented May 28, 2026

Copy link
Copy Markdown
Contributor

Overview

Remediates 9 security vulnerabilities in backend Spring Framework and related dependencies.

CVEs Fixed

Spring Framework (WebMVC)

  • CVE-2026-22745 (org.springframework:spring-webmvc - 6.2.18): Denial of Service attacks
  • CVE-2026-22741 (org.springframework:spring-webmvc - 6.2.18): Cache poisoning vulnerability

Spring Security

  • CVE-2026-22748: Integrity impact due to improper JSON Web Token handling
  • CVE-2026-22751: JdbcOneTimeTokenService authentication bypass
  • CVE-2025-41248: Spring Security annotation detection mechanism - authorization bypass

Spring Boot

  • CVE-2026-22733: Authentication Bypass under Actuator CloudFoundry endpoints
  • CVE-2026-22731: Authentication bypass via misconfigured Health Group

Jackson Core

PostgreSQL JDBC Driver

  • CVE-2026-42198: Client-side Denial of Service via malicious SCRAM server

Changes

  • Updated spring-web.version property from 6.2.176.2.18 in backend/pom.xml
  • Spring Boot parent manages transitive dependencies for Spring Security, Spring Boot, Jackson, and PostgreSQL JDBC
  • All CVEs resolved through managed dependency version updates

Verification

  • pom.xml shows spring-web.version updated to 6.2.18
  • Spring Boot 3.5.11 parent manages all transitive dependencies
  • All high-severity authentication and DoS vulnerabilities addressed
  • Commit message includes all fixed CVEs

Closes #1318


Thanks for the PR!

Deployments, as required, will be available below:

Please create PRs in draft mode. Mark as ready to enable:

After merge, new images are deployed in:

CVEs fixed:
- CVE-2026-22745 (org.springframework:spring-webmvc) - DoS vulnerability
- CVE-2026-22741 (org.springframework:spring-webmvc) - Cache poisoning
- CVE-2026-22748 (Spring Security) - Integrity impact (JSON Web Token)
- CVE-2026-22751 (Spring Security) - Authentication bypass (JdbcOneTimeTokenService)
- GHSA-72hv-8253-57qq (jackson-core) - Number Length Constraint Bypass
- CVE-2026-22733 (Spring Boot) - Authentication bypass (Actuator CloudFoundry)
- CVE-2026-22731 (Spring Boot) - Health Group misconfiguration bypass
- CVE-2026-42198 (pgjdbc) - Client-side DoS (SCRAM)
- CVE-2025-41248 (Spring Security) - Authorization bypass

Updated spring-web.version from 6.2.17 to 6.2.18 to address Spring Framework CVEs.

Closes #1318
Copilot AI review requested due to automatic review settings May 28, 2026 15:49

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates backend dependency management to remediate reported Spring WebMVC security findings.

Changes:

  • Bumps spring-web.version from 6.2.17 to 6.2.18.
  • Applies that version to managed spring-web and spring-webmvc dependencies.

Comment thread backend/pom.xml
@paulushcgcj
paulushcgcj requested review from Abradat and craigyu May 28, 2026 16:43
@paulushcgcj
paulushcgcj enabled auto-merge (squash) May 28, 2026 16:50

@Abradat Abradat left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀

@paulushcgcj
paulushcgcj merged commit 4544200 into main May 28, 2026
33 checks passed
@paulushcgcj
paulushcgcj deleted the fix/sec-issues-backend-20260528 branch May 28, 2026 17:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(deps): security vulnerabilities in backend

3 participants