spring-web
Spring Web
84%
Total Score
healthy
Healthy overall, backed by active project work despite the prerelease version and workflow hygiene findings.
Health Score Breakdown
The repository name does not match this module and its README does not mention the package, which creates some uncertainty about package-to-repository mapping. Organization backing and the repository's framework-scale source tree partly compensate, but do not remove that gap.
7.1.0-M2 is a prerelease, so APIs and behavior may still change even though prereleases are a minority of recent releases.
All 14 workflows were analyzed without failures; six of 24 action references are unpinned, one workflow has top-level write permissions, and high-confidence template-injection findings appear in release workflows. With no untrusted checkout or script-injection trigger reported, these are workflow hygiene concerns rather than a severe health risk.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-620042 spring-web is vulnerable to HTTP Request/Response Splitting in versions 0.0.1 - 7.0.8. | 0.0.1 - 7.0.8 | Low |
AIKIDO-2026-11158 spring-web is vulnerable to Cross-site Scripting (XSS) in versions 5.3.0 - 6.2.18 and 7.0.0 - 7.0.7. | 5.3.0 - 6.2.187.0.0 - 7.0.7 | High |
CVE-2026-41854 org.springframework:spring-web is vulnerable to Server-Side Request Forgery (SSRF) in versions 7.0.0 - 7.0.7 and 6.2.0 - 6.2.18. | 6.2.0 - 6.2.187.0.0 - 7.0.7 | Medium |
CVE-2025-41234 org.springframework:spring-web is vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in versions 6.2.0 - 6.2.8, 6.1.0 - 6.1.21 and 6.0.5 - 6.0.23. | 6.0.5 - 6.0.236.1.0 - 6.1.216.2.0 - 6.2.8 | Medium |
AIKIDO-2024-10361 spring-web is vulnerable to Improper Handling of Case Sensitivity in versions 0.0.1 - 5.3.40, 6.0.0 - 6.0.24 and 6.1.0 - 6.1.13. | 0.0.1 - 5.3.406.0.0 - 6.0.246.1.0 - 6.1.13 | Low |
Package versions
Maintainers
No maintainer information available.
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 org.springframework:spring-beans Version 7.1.0-M2 | — | — |
org.springframework:spring-core Version 7.1.0-M2 | — | — |
io.micrometer:micrometer-observation Version 1.18.0-M2 | — | — |
Weekly Downloads
Info
- Last Published
- 18 days ago
- Created
- 10 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.