[
https://issues.apache.org/jira/browse/WW-5717?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18114094#comment-18114094
]
Lukasz Lenart edited comment on WW-5717 at 9/11/26 5:27 AM:
------------------------------------------------------------
Scan output recorded, as the description asked for.
*What the OWASP workflow reports* (run 34560133237, 2026-09-11,
{{-Pdependency-check -Pjakartaee11}}, fails on CVSS >= 7):
{{spring-core-7.0.8.jar}} with 17 CVEs, all from Spring's 2026-08-20 advisory
wave, 12 of them >= 7.0. The CPE match is {{spring_framework}}, so every
{{spring-*.jar}} at that version is in scope, not only {{spring-core}}.
||CVE||CVSS||Component||Shipped / used by Struts?||
|CVE-2026-47884, CVE-2026-47887, CVE-2026-59280|9.8 / 6.1 / 4.3|Spring MVC
views ({{XsltView}}, {{UrlFileNameViewController}}, {{FreeMarkerView}})|no - no
{{spring-webmvc}} anywhere|
|CVE-2026-47890, CVE-2026-59313|9.8 / 9.8|MVC/WebFlux SSE view fragments|no|
|CVE-2026-47885, CVE-2026-47889, CVE-2026-47891, CVE-2026-47892,
CVE-2026-47893|7.5-9.8|WebFlux|no|
|CVE-2026-47888|7.5|RSocket|no|
|CVE-2026-47883|6.1|{{UrlHandlerFilter}} (spring-web)|shipped, not used|
|CVE-2026-59314|3.7|{{ContentDisposition}} builder (spring-web)|shipped, not
used|
|CVE-2026-47886, CVE-2026-59283|7.5 / 9.1|SpEL (spring-expression)|shipped via
spring-context, not used|
|CVE-2026-59282|7.5|Spring {{DataBinder}} DoS (spring-beans)|shipped, not used
- Struts binds via OGNL|
|CVE-2026-59281|6.1|{{Errors.getFieldErrors}} HTML escaping|no|
Compile-scope Spring in the tree: {{struts2-spring-plugin}}
(core/beans/context/web/aop/aspects/context-support), {{struts2-rest-plugin}}
(core/web), {{junit}} and {{testng}} plugins. None of the 17 is on a code path
the framework executes, so this is dependency hygiene, not a Struts fix.
*Fix availability (Maven Central)*
{{7.0.9}} fixes all 17 and is bumped in the {{jakartaee11}} profile, which is
what CI scans.
{{6.2.19}} (default profile) is the last OSS 6.2.x; {{6.2.20}} is
Enterprise-Support-only. Left as is and deliberately not suppressed - see
WW-5721 for the real decision (default Spring line is OSS-EOL, 8.0.0).
{{support/struts-6-x-x}} is on {{5.3.39}}, also the last OSS release of its
line ({{5.3.50}} is ES-only); 6.x has no OWASP workflow. No change there.
*Verification of the bump:* 224 tests across the spring/rest/junit/testng
plugins under {{-Pjakartaee11}}, 0 failures; the same
{{dependency-check:aggregate}} CI runs, against an NVD cache refreshed today,
scans 169 dependencies with all nine Spring jars at 7.0.9 and reports no 2026
Spring CVE.
was (Author: lukaszlenart):
Scan output recorded, as the description asked for.
*What the OWASP workflow reports* (run 34560133237, 2026-09-11,
{{-Pdependency-check -Pjakartaee11}}, fails on CVSS >= 7):
{{spring-core-7.0.8.jar}} with 17 CVEs, all from Spring's 2026-08-20 advisory
wave, 12 of them >= 7.0. The CPE match is {{spring_framework}}, so every
{{spring-*.jar}} at that version is in scope, not only {{spring-core}}.
||CVE||CVSS||Component||Shipped / used by Struts?||
|CVE-2026-47884, CVE-2026-47887, CVE-2026-59280|9.8 / 6.1 / 4.3|Spring MVC
views ({{XsltView}}, {{UrlFileNameViewController}}, {{FreeMarkerView}})|no - no
{{spring-webmvc}} anywhere|
|CVE-2026-47890, CVE-2026-59313|9.8 / 9.8|MVC/WebFlux SSE view fragments|no|
|CVE-2026-47885, CVE-2026-47889, CVE-2026-47891, CVE-2026-47892,
CVE-2026-47893|7.5-9.8|WebFlux|no|
|CVE-2026-47888|7.5|RSocket|no|
|CVE-2026-47883|6.1|{{UrlHandlerFilter}} (spring-web)|shipped, not used|
|CVE-2026-59314|3.7|{{ContentDisposition}} builder (spring-web)|shipped, not
used|
|CVE-2026-47886, CVE-2026-59283|7.5 / 9.1|SpEL (spring-expression)|shipped via
spring-context, not used|
|CVE-2026-59282|7.5|Spring {{DataBinder}} DoS (spring-beans)|shipped, not used
- Struts binds via OGNL|
|CVE-2026-59281|6.1|{{Errors.getFieldErrors}} HTML escaping|no|
Compile-scope Spring in the tree: {{struts2-spring-plugin}}
(core/beans/context/web/aop/aspects/context-support), {{struts2-rest-plugin}}
(core/web), {{junit}} and {{testng}} plugins. None of the 17 is on a code path
the framework executes, so this is dependency hygiene, not a Struts fix.
*Fix availability (Maven Central):*
* {{7.0.9}} - fixes all 17; bumped in the {{jakartaee11}} profile, which is
what CI scans.
* {{6.2.19}} (default profile) is the last OSS 6.2.x; {{6.2.20}} is
Enterprise-Support-only. Left as is and *not* suppressed - see WW-5721 for the
real decision (default Spring line is OSS-EOL, 8.0.0).
* {{support/struts-6-x-x}} is on {{5.3.39}}, also the last OSS release of its
line ({{5.3.50}} is ES-only); 6.x has no OWASP workflow. No change there.
*Verification of the bump:* 224 tests across the spring/rest/junit/testng
plugins under {{-Pjakartaee11}}, 0 failures; the same
{{dependency-check:aggregate}} CI runs, against an NVD cache refreshed today,
scans 169 dependencies with all nine Spring jars at 7.0.9 and reports no 2026
Spring CVE.
> Address OWASP dependency-check finding in Spring Framework (spring-core)
> ------------------------------------------------------------------------
>
> Key: WW-5717
> URL: https://issues.apache.org/jira/browse/WW-5717
> Project: Struts 2
> Issue Type: Task
> Reporter: Lukasz Lenart
> Assignee: Lukasz Lenart
> Priority: Minor
> Fix For: 7.4.0
>
>
> The OWASP dependency-check run (the {{owasp-nvd-api}} profile, which is
> configured with {{failBuildOnCVSS=0}} so it reports every CVE regardless of
> severity) flags a vulnerability in Spring Framework's {{spring-core}}.
> This is a dependency-hygiene item, independent of any current feature branch
> — no source change introduced it; it stems from the pinned Spring version.
> h3. Current Spring versions
> * _main (7.x):_ {{spring.version}} = {{6.2.19}} (default), {{7.0.8}}
> (jakartaee11 profile)
> * _support/struts-6-x-x (6.x):_ {{spring.platformVersion}} = {{5.3.39}}
> Both lines should be checked against the reported CVE, since they track
> different Spring release lines.
> h3. Resolution options
> # _Upgrade_ Spring to the latest patch of its respective line (6.2.x / 7.0.x
> on main, 5.3.x on 6.x) if the CVE is fixed upstream, and confirm the finding
> clears.
> # _Suppress_ the finding in the OWASP suppression file
> ({{src/etc/project-suppression.xml}}) if the CVE does not apply to how Struts
> uses Spring (a common situation for dependency-check + Spring). The file
> already curates such false positives; no Spring CVE is suppressed there today.
> h3. Notes
> * {{spring-core}} is not shipped by every module; e.g. the Tiles plugin only
> pulls {{spring-test}} (test scope).
> * The exact CVE id from the scan output should be recorded here to drive the
> decision (upgrade vs. suppress) and to document the rationale if suppressed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
