Package Health/org.springframework:spring-beans

spring-beans

Spring Beans

Latest 7.1.0-M2org.springframework

Maven

86%

Total Score

healthy

Healthy release backed by active, well-supported development and signed publication; the main caveat is that this is a prerelease.

Are you affected? Scan for Free

Health Score Breakdown

Repo tooling

The project uses Gradle, but no security scanning tools were detected. This is a modest transparency gap, offset by the repository’s active maintenance and separate security policy.

Version stability

This release is a prerelease milestone, so it may carry more API or behavior change risk than a final release, although the major line itself is established and only 15% of recent releases are prereleases.

Workflow audit

All 14 workflows were analyzed without untrusted checkouts or script-injection findings; most use read-only or job-level permissions. Six of 24 action references are unpinned, and high-confidence template-injection findings remain workflow hygiene concerns, but no dangerous trigger-and-sink combination was observed.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-349640 spring-beans is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 7.0.8.	0.0.1 - 7.0.8	Medium
CVE-2024-38827 org.springframework:spring-beans is vulnerable to Authorization Bypass Through User-Controlled Key.	—	Medium
CVE-2022-22970 org.springframework:spring-beans is vulnerable to Allocation of Resources Without Limits or Throttling in versions 0.0.0 - 5.2.21.RELEASE and 5.3.0 - 5.3.20.	0.0.0 - 5.2.21.RELEASE5.3.0 - 5.3.20	High
CVE-2022-22965 org.springframework:spring-beans is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in versions 5.3.0 - 5.3.18 and 0.0.0 - 5.2.20.RELEASE.	0.0.0 - 5.2.20.RELEASE5.3.0 - 5.3.18	Critical