Broadcom’s Spring framework shipped a patch batch covering 91 vulnerabilities last week, pushing the 2026 total past 200 as AI-assisted review keeps surfacing new flaws.
One bug carries a critical rating: CVE-2026-59270, an issue in Spring Security’s embedded UnboundID LDAP server that lets an attacker authenticate and modify entries in the in-memory directory. More than a dozen others rank high severity, spanning cross-site scripting, information disclosure, remote code execution, denial of service, security bypasses, and unauthorized access.
Sonatype’s analysis of the release says the fixes touch more than 200,000 software components across projects including Spring Security, Spring AI, Cloud Config, Data REST, Integration, Reactor Core, Reactor Netty, AMQP, and Batch.
The firm flags two more: CVE-2026-59285, a critical remote code execution issue in Spring for GraphQL, and CVE-2026-59318, a medium-severity flaw in Spring AI’s tool-calling that enables privilege escalation through prompt injection.
The surge in findings is attributed to Broadcom’s use of AI in code review, which catches more issues per release cycle. Enterprises running Spring should map their dependencies against the advisory and prioritize the LDAP and GraphQL fixes, since both sit in components that commonly face the network.
