91 Spring CVEs Impact Over 209,000 Software Components Across the Supply Chain

Broadcom disclosed 91 CVEs across Spring projects (Spring Security, Spring Cloud, Spring GraphQL, Spring AI, Reactor, and more), including a critical CVE-2026-59285 (unsafe deserialization, CVSS 9.2); Sonatype estimates approximately 209,569 impacted software components, underscoring widespread supply-chain exposure and remediation challenges—organizations are advised to inventory affected versions, prioritize internet-facing services and GraphQL/AI-exposed apps, and apply upgrades while validating compatibility.