Read the docs
TI-2016-09283 Aliases CVE-2016-1000027GHSA-4wrc-f8pq-fpqp

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution…

Priority HIGH 74CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.33179 98th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed org.springframework:spring-web (Maven): 6.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.springframework:spring-web (Maven)before 6.0.06.0.0Patch availableGHSA-4wrc-f8pq-fpqp
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.springframework:spring-web (Maven) Vendor— Affected before 6.0.0 Fixed in 6.0.0 Patch available GHSA-4wrc-f8pq-fpqp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*before 6.0.0VulnerableVMware
  • cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions before 6.0.0 Vulnerable ·VMware

Remediation

  • Fix · GHSA-4wrc-f8pq-fpqp org.springframework:spring-web (Maven) Fixed in 6.0.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 7 products
  • OpenShift Developer Tools and Services
  • Red Hat Enterprise Virtualization 3
  • Red Hat Fuse 7
  • Red Hat JBoss Fuse 6
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Enterprise 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-1000027
  2. 2026-10-03 Alias added: GHSA-4wrc-f8pq-fpqp
  3. 2026-10-07 CVSS score added · CISA ADP
  4. 2026-10-07 Weakness changed · CISA ADP
  5. 2026-10-07 CISA SSVC decision points changed

References

Exploit 2

Advisory 7

Other 10

  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
  • TI-2018-01180 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2014-00050 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8… CVSS 2.0MEDIUM 6.8
  • TI-2013-05382 The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and… CVSS 2.0MEDIUM 6.8
See all 82 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences