Multiple Security Flaws Fixed in Major Framework Release

This advisory details critical vulnerabilities in the Spring framework (CVE-2026-41003, CVE-2026-40999, CVE-2026-40998, CVE-2026-40994) that can enable authenticated cross-site scripting, outbound SSRF to internal/cloud metadata endpoints, XML external entity attacks, and validation bypasses; administrators are urged to update to Spring 7.0.6 or 6.5.11 immediately to mitigate these risks.