Is org.springframework:spring-webmvc safe to use?

org.springframework:spring-webmvc has 16 known vulnerabilities on the latest version (7.0.0-M6). DepScope rates its health at 49/100 (high risk).

What is the latest version of org.springframework:spring-webmvc?

The latest version of org.springframework:spring-webmvc is 7.0.0-M6, released 2025-06-12.

Does org.springframework:spring-webmvc have known vulnerabilities?

Yes. org.springframework:spring-webmvc has 16 known vulnerabilities. See depscope.dev/pkg/maven/org.springframework:spring-webmvc for details.

Is org.springframework:spring-webmvc deprecated?

No, org.springframework:spring-webmvc is actively maintained. Latest release: 7.0.0-M6 (2025-06-12).

What are alternatives to org.springframework:spring-webmvc?

DepScope has no curated alternatives for org.springframework:spring-webmvc at this time.

What license does org.springframework:spring-webmvc use?

org.springframework:spring-webmvc is licensed under Apache-2.0.

org.springframework:spring-webmvc

mavenv7.0.0-M6

Spring Web MVC

License Apache-2.0permissive311 versions0 deps551,061 weekly dl

spring-projects/spring-framework

/ 100

Health

do not use

org.springframework:spring-webmvc has critical vulnerabilities — do not use

Update to >= 5.3.42 to fix known vulnerabilities

6 high severity vulnerabilities
2 critical vulnerabilities

Health breakdown0 – 100

10/25

maintenance

14/20

popularity

0/25

security

15/15

maturity

10/15

community

Vulnerabilities

2 critical6 high7 medium1 low

Advisories (16)

Severity	ID	Summary	Fixed in
high	CVE-2016-9878	Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized	4.3.5
critical	CVE-2022-22965	Remote Code Execution in Spring Framework	2.6.6
medium	CVE-2026-22737	Spring Framework Improper Path Limitation with Script View Templates	6.2.17
low	CVE-2026-22735	Spring MVC and WebFlux has Server Sent Event stream corruption	6.2.17
critical	CVE-2023-20860	Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch	5.3.26
medium	CVE-2020-5397	CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux	5.2.3
medium	CVE-2014-0054	Cross-Site Request Forgery in Spring Framework	4.0.2
high	CVE-2020-5398	RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application	5.0.16.RELEASE
high	CVE-2024-38816	Path traversal vulnerability in functional web frameworks	6.1.13
high	CVE-2014-0225	Improper Restriction of XML External Entity Reference in Spring Framework	3.2.8
medium	CVE-2014-1904	Improper Neutralization of Input During Web Page Generation in Spring Framework	4.0.2.RELEASE
high	CVE-2024-38819	Spring Framework Path Traversal vulnerability	6.1.14
medium	CVE-2014-3625	Improper Limitation of a Pathname to a Restricted Directory in Spring Framework	4.1.2
medium	CVE-2025-41242	Spring Framework MVC Applications Path Traversal Vulnerability	6.2.10
high	CVE-2023-34053	Spring Framework vulnerable to denial of service	6.0.14
medium	CVE-2024-38828	Spring MVC controller vulnerable to a DoS attack	5.3.42

Threat intelligence

1 actively exploited (CISA KEV)4 likely exploited (EPSS ≥ 0.5)

Threat tier per vulnerability derived from CISA KEV catalog + FIRST.org EPSS scores.

OSS Scorecard

OpenSSF security posture score

5.7/10

moderate

Maintainer trust

Active maintainers (3m)

16

Contributors (12m)

16

Primary author dominance

60%

GitHub stars

59,858

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/maven/org.springframework:spring-webmvc

Last updated · 2025-06-12T10:14:08+00:00

Severity

Summary

Fixed in

high

CVE-2016-9878

Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized

4.3.5

critical

CVE-2022-22965

Remote Code Execution in Spring Framework

2.6.6

medium

CVE-2026-22737

Spring Framework Improper Path Limitation with Script View Templates

6.2.17

low

CVE-2026-22735

Spring MVC and WebFlux has Server Sent Event stream corruption

6.2.17

critical

CVE-2023-20860

Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

5.3.26

medium

CVE-2020-5397

CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux

5.2.3

medium

CVE-2014-0054

Cross-Site Request Forgery in Spring Framework

4.0.2

high

CVE-2020-5398

RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

5.0.16.RELEASE

high

CVE-2024-38816

Path traversal vulnerability in functional web frameworks

6.1.13

high

CVE-2014-0225

Improper Restriction of XML External Entity Reference in Spring Framework

3.2.8

medium

CVE-2014-1904

Improper Neutralization of Input During Web Page Generation in Spring Framework

4.0.2.RELEASE

high

CVE-2024-38819

Spring Framework Path Traversal vulnerability

6.1.14

medium

CVE-2014-3625

Improper Limitation of a Pathname to a Restricted Directory in Spring Framework

4.1.2

medium

CVE-2025-41242

Spring Framework MVC Applications Path Traversal Vulnerability

6.2.10

high

CVE-2023-34053

Spring Framework vulnerable to denial of service

6.0.14

medium

CVE-2024-38828

Spring MVC controller vulnerable to a DoS attack

5.3.42