CVE-2016-1000027: vmware spring_framework Deserialization of Untrusted Data
Vulnerability summary
CVE-2016-1000027 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in vmware spring_framework. EPSS estimates a 33.18% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 6Timeline
- 02-01-2020PublishedVulnerability first disclosed.
- 07-10-2026Last modifiedVulnerability information updated.
Description
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CVSS metrics
7 scores · 6 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
33.18%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
+0.92 pp
From 32.26% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (tenable.com)
Maturity: unknown
Exploit Reference (raw.githubusercontent.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard20 products
- apache-activemq-5.19All versions (No fix recorded)
- apache-activemq-fips-5.19All versions (No fix recorded)
- apache-nifiAll versions (No fix recorded)
- apache-nifi-compatAll versions (No fix recorded)
- apache-nifi-toolkitAll versions (No fix recorded)
Wolfi3 products
- apache-nifiAll versions (No fix recorded)
- apache-nifi-compatAll versions (No fix recorded)
- apache-nifi-toolkitAll versions (No fix recorded)
Debian1 product
- libspring-java< 4.2.7-1
Org.springframework1 product
- spring-web< 6.0.0
Vmware1 product
- spring_framework< 6.0.0
5 vendors · 26 products
References
19 links
- spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-nowRelease NotesThird Party AdvisoryAdvisoryWEB
