{"schemaVersion":3,"id":"CVE-2026-22737","aliases":["UBUNTU-CVE-2026-22737","DEBIAN-CVE-2026-22737","CGA-43g7-hhhc-845x","CGA-4vr5-9xw8-qg7q","CGA-6j6j-8h75-7397","CGA-8242-wpgj-ghh2","CGA-hf59-3hvx-p9h4","CGA-r476-gr5j-259q","CGA-r728-gqc8-jrmv","CGA-w8xc-xm7x-hv6q","CGA-26mc-f7wx-3hp6","CGA-2xf3-jvq5-hrvr","CGA-327f-9mp6-48jp","CGA-34hh-h3p4-fqcx","CGA-3p4x-w5v5-2rc7","CGA-3pm5-9452-hgc4","CGA-42gm-hpx7-vhqc","CGA-42wx-wf97-6mqp","CGA-4574-386h-6w47","CGA-46w4-j5qh-qmr6","CGA-4c62-55wr-h8w4","CGA-539h-wrxx-8pgx","CGA-58p8-hvg7-mcx7","CGA-5927-m3f9-3x65","CGA-5hgv-x75f-2pc6","CGA-5xrx-x673-4729","CGA-63xh-jf9f-fjp3","CGA-64vh-749p-ggmm","CGA-64wq-c99f-cr3f","CGA-67vg-9mh3-mxgw","CGA-6943-c22v-mfg5","CGA-6gg5-rc7h-qvvx","CGA-6m4h-j4cg-3m48","CGA-7886-39pp-q6p9","CGA-7gpc-57vr-4f42","CGA-7gw8-92r4-h23r","CGA-7q3g-6q9f-39jr","CGA-7qvm-v2wg-2xqw","CGA-7r6h-w557-9385","CGA-7v5j-8cpw-r8q7","CGA-84mc-m639-8vgv","CGA-89pw-m5qg-7c77","CGA-8h9w-2wfv-rmrq","CGA-8rrc-c4p8-9285","CGA-8w5x-2qmx-hjj2","CGA-8wf2-wh2m-wm6f","CGA-8x2v-hwc2-rf8c","CGA-9997-hpx5-jfm5","CGA-9f9r-vqp3-p5jh","CGA-9ffq-5f54-xrw9","CGA-9jp9-f4gm-wx24","CGA-9jvx-38qr-7cf6","CGA-9m73-9ch6-wmj9","CGA-cchc-2557-f6x2","CGA-cw97-wf5w-6vp5","CGA-f6vh-rm4f-p5r7","CGA-f93v-fc2g-6q45","CGA-fc2c-q4gj-66cp","CGA-fgxp-2f8c-8gqq","CGA-fjhq-8976-5v9w","CGA-fm2c-qqrr-74cc","CGA-frmh-qpfv-3wg4","CGA-g9cq-3vhc-c28j","CGA-g9ff-p5gv-cf53","CGA-g9hw-8v57-8f54","CGA-ggq9-8v35-prrr","CGA-ggqp-6x4m-7fjm","CGA-h6gj-w5fm-5gvh","CGA-h6xj-534c-cw9w","CGA-hcqg-mq74-hfgc","CGA-hgph-837p-f3hc","CGA-hh4x-7pf3-xxq4","CGA-hrq8-3988-68mx","CGA-hxv6-xx3c-v4fr","CGA-j25v-49xf-q6xm","CGA-jfvp-vc83-m9mf","CGA-jg9w-hrhf-mc9j","CGA-m45c-g748-gjxw","CGA-m5w7-q4g8-g6rc","CGA-mfv3-f2cg-353x","CGA-mhmm-5qq7-jrwr","CGA-mmq2-3hq2-rph5","CGA-p2vw-m9cq-x87v","CGA-p4gp-p8pj-j85v","CGA-p7x7-8mrm-w575","CGA-p9w9-g5cj-fx82","CGA-phvf-3fmv-fmcg","CGA-ppfm-gm37-52vv","CGA-prjf-mpgv-q853","GHSA-4773-3jfm-qmx3","CGA-pxg7-x5j6-r6h7","CGA-q44h-xcch-w8wf","CGA-qpqg-gpp4-vgwx","CGA-r5w6-vhh7-95vc","CGA-r7gc-8257-rhvf","CGA-rf5q-hgmf-3x24","CGA-vxf6-2h3c-7px6","CGA-vxg9-78p9-5ccv","CGA-wc3f-8jh7-cxjp","CGA-wfc9-vhxp-2wvq","CGA-wrwr-vf6q-pc5w","CGA-wvf5-rfhc-g5j2","CGA-xjr5-cw8m-824m","CGA-xm7c-gr33-cp74","CGA-xq3x-cw2g-f487","CGA-xx65-2whv-wgp9","CGA-xxxh-xjrm-3wxq"],"status":"published","duplicateOf":null,"title":null,"description":"Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.","dates":{"published":"2026-03-19T23:53:59.918Z","modified":"2026-03-20T14:43:50.722Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.9,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Maven","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.004,"percentile":0.32761,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.014999999999999996,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00385},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.004,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.004,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.004,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.004,"percentile":0.32761}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00385,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.004,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.004,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.004,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.004,"percentile":0.32761}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"chainguard","product":"apache-activemq-5.19","name":"apache-activemq-5.19","label":"apache-activemq-5.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-activemq-5.19","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-activemq-6.1","name":"apache-activemq-6.1","label":"apache-activemq-6.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-activemq-6.1","purlType":"apk","versions":[{"text":"< 6.1.8-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.1.8-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-activemq-fips-5.19","name":"apache-activemq-fips-5.19","label":"apache-activemq-fips-5.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-activemq-fips-5.19","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-activemq-fips-6.1","name":"apache-activemq-fips-6.1","label":"apache-activemq-fips-6.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-activemq-fips-6.1","purlType":"apk","versions":[{"text":"< 6.1.8-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.1.8-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apache-nifi-registry","name":"apache-nifi-registry","label":"apache-nifi-registry","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apache-nifi-registry","purlType":"apk","versions":[{"text":"< 2.8.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.8.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-8.8","name":"camunda-8.8","label":"camunda-8.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-8.8","purlType":"apk","versions":[{"text":"< 8.8.22-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.8.22-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.6","name":"camunda-zeebe-8.6","label":"camunda-zeebe-8.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.6","purlType":"apk","versions":[{"text":"< 8.6.39-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.6.39-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.7","name":"camunda-zeebe-8.7","label":"camunda-zeebe-8.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.7","purlType":"apk","versions":[{"text":"< 8.7.27-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.7.27-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"camunda-zeebe-8.8","name":"camunda-zeebe-8.8","label":"camunda-zeebe-8.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/camunda-zeebe-8.8","purlType":"apk","versions":[{"text":"< 8.8.22-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.8.22-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"conductor","name":"conductor","label":"conductor","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/conductor","purlType":"apk","versions":[{"text":"< 3.31.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.31.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"conductor-fips","name":"conductor-fips","label":"conductor-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/conductor-fips","purlType":"apk","versions":[{"text":"< 3.31.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.31.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"geoserver-2.27","name":"geoserver-2.27","label":"geoserver-2.27","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/geoserver-2.27","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"geoserver-2.28","name":"geoserver-2.28","label":"geoserver-2.28","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/geoserver-2.28","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kafbat-ui","name":"kafbat-ui","label":"kafbat-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kafbat-ui","purlType":"apk","versions":[{"text":"< 1.4.2-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kafbat-ui-fips","name":"kafbat-ui-fips","label":"kafbat-ui-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kafbat-ui-fips","purlType":"apk","versions":[{"text":"< 1.4.2-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.4.2-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.0","name":"kayenta-2025.0","label":"kayenta-2025.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.1","name":"kayenta-2025.1","label":"kayenta-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.2","name":"kayenta-2025.2","label":"kayenta-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2025.4","name":"kayenta-2025.4","label":"kayenta-2025.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2025.4","purlType":"apk","versions":[{"text":"< 2025.4.3-r7","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 2025.4.3-r7 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2026.0","name":"kayenta-2026.0","label":"kayenta-2026.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2026.0","purlType":"apk","versions":[{"text":"< 2026.0.2-r6","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 2026.0.2-r6 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-2026.1","name":"kayenta-2026.1","label":"kayenta-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-2026.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.0","name":"kayenta-fips-2025.0","label":"kayenta-fips-2025.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.1","name":"kayenta-fips-2025.1","label":"kayenta-fips-2025.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.2","name":"kayenta-fips-2025.2","label":"kayenta-fips-2025.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2025.4","name":"kayenta-fips-2025.4","label":"kayenta-fips-2025.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2025.4","purlType":"apk","versions":[{"text":"< 2025.4.3-r7","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 2025.4.3-r7 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2026.0","name":"kayenta-fips-2026.0","label":"kayenta-fips-2026.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2026.0","purlType":"apk","versions":[{"text":"< 2026.0.2-r7","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 2026.0.2-r7 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kayenta-fips-2026.1","name":"kayenta-fips-2026.1","label":"kayenta-fips-2026.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kayenta-fips-2026.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos","name":"nacos","label":"nacos","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos","purlType":"apk","versions":[{"text":"< 3.2.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nacos-docker","name":"nacos-docker","label":"nacos-docker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nacos-docker","purlType":"apk","versions":[{"text":"< 3.2.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.2.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ontop","name":"ontop","label":"ontop","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ontop","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ontop-fips","name":"ontop-fips","label":"ontop-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ontop-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-mqtt-transport","name":"thingsboard-tb-mqtt-transport","label":"thingsboard-tb-mqtt-transport","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-mqtt-transport","purlType":"apk","versions":[{"text":"< 4.3.1.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.3.1.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"apache-nifi-registry","name":"apache-nifi-registry","label":"apache-nifi-registry","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/apache-nifi-registry","purlType":"apk","versions":[{"text":"< 2.8.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.8.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-mqtt-transport","name":"thingsboard-tb-mqtt-transport","label":"thingsboard-tb-mqtt-transport","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-mqtt-transport","purlType":"apk","versions":[{"text":"< 4.3.1.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-node","name":"thingsboard-tb-node","label":"thingsboard-tb-node","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-node","purlType":"apk","versions":[{"text":"< 4.3.1.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.1.1-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"libspring-java","name":"libspring-java","label":"libspring-java","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libspring-java","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"libspring-java","name":"libspring-java","label":"libspring-java","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libspring-java","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"org.springframework","product":"spring-webflux","name":"org.springframework:spring-webflux","label":"spring-webflux","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.springframework/spring-webflux","purlType":"maven","versions":[{"text":"≥ 7.0.0-M1, < 7.0.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.0, < 6.2.17","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, ≤ 6.1.21","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.3.0, ≤ 5.3.39","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0.0-M1, < 7.0.6 | ≥ 6.2.0, < 6.2.17 | ≥ 6.0.0, ≤ 6.1.21 | ≥ 5.3.0, ≤ 5.3.39","eol":null,"hubHref":null},{"vendor":"org.springframework","product":"spring-webmvc","name":"org.springframework:spring-webmvc","label":"spring-webmvc","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.springframework/spring-webmvc","purlType":"maven","versions":[{"text":"≥ 7.0.0-M1, < 7.0.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.0, < 6.2.17","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.0, ≤ 6.1.21","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.3.0, ≤ 5.3.39","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0.0-M1, < 7.0.6 | ≥ 6.2.0, < 6.2.17 | ≥ 6.0.0, ≤ 6.1.21 | ≥ 5.3.0, ≤ 5.3.39","eol":{"isEol":null,"eolDate":null,"matchMethod":"purl","cycle":null,"product":{"name":"spring-framework","label":"Spring Framework","category":"framework"}},"hubHref":null},{"vendor":"spring","product":"spring framework","name":"Spring Framework","label":"spring framework","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.0.0, ≤ 7.0.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.0, ≤ 6.2.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.1.0, ≤ 6.1.25","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.3.0, ≤ 5.3.46","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0.0, ≤ 7.0.5 | ≥ 6.2.0, ≤ 6.2.16 | ≥ 6.1.0, ≤ 6.1.25 | ≥ 5.3.0, ≤ 5.3.46","eol":null,"hubHref":"/vendor/spring/spring_framework"},{"vendor":"vmware","product":"spring_framework","name":"Spring Framework","label":"spring_framework","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.3.47","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.1.0, < 6.1.26","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.0, < 6.2.17","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.3.47 | ≥ 6.1.0, < 6.1.26 | ≥ 6.2.0, < 6.2.17 | ≥ 7.0.0, < 7.0.6","eol":null,"hubHref":"/vendor/vmware/spring_framework"}],"affectedCount":42,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://spring.io/security/cve-2026-22737","label":"spring.io/security/cve-2026-22737","hostname":"spring.io","tags":["REPORT","WEB","Vendor Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-22737","label":"ubuntu.com/security/CVE-2026-22737","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22737","label":"www.cve.org/CVERecord?id=CVE-2026-22737","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-22737","label":"security-tracker.debian.org/tracker/CVE-2026-22737","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22737","label":"nvd.nist.gov/vuln/detail/CVE-2026-22737","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/spring-projects/spring-framework","label":"github.com/spring-projects/spring-framework","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-7VR7-8QXR-V5R4"]},"timeline":[{"kind":"published","date":"2026-03-19T23:53:59.918Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-03-20T14:43:50.722Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":24,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T03:06:39.718Z","stale":false,"partial":false}}