Spring Security Advisories is a repository for reporting security vulnerabilities to Spring Projects.
The repository serves as the official channel for disclosing security issues affecting any Spring Project. It establishes clear criteria for what constitutes a valid CVE: a security vulnerability must be directly caused by Spring's own code, where Spring itself allows untrusted input to be processed insecurely. The repository provides detailed guidance distinguishing valid vulnerabilities from non-qualifying issues, including examples of problems that stem from developer misuse, vulnerabilities in Spring's dependencies, or transitive dependency versions, which fall outside the scope of Spring CVEs.
Developers should use this repository only to report vulnerabilities that meet the strict definition of a Spring-caused security issue. The repository explicitly excludes insecure application code written by developers using Spring, vulnerabilities in Spring's dependencies, unsafe deserialization patterns that depend on application configuration, vulnerable dependency versions, unsupported versions, unrealistic threat environments, and sample code issues. Anyone considering filing a report should first review the documented security policy and examples of both valid and invalid CVEs to confirm their issue qualifies before creating a report.
The project maintains a curated list of accepted security advisories published at the Spring security page, which serve as reference examples of valid CVEs. The repository's development activity centers on maintaining clear documentation and guidance to help reporters understand the scope and criteria for Spring security vulnerabilities, ensuring that only genuine Spring framework vulnerabilities are processed through this channel.
