Spring Vulnerabilities: 91 CVEs Expose Supply Chain Risk

This report summarizes a large August 2026 Spring ecosystem security disclosure covering 91 CVEs across Spring projects (including GraphQL, Spring AI, Cloud, Data, Reactor, AMQP and Batch), highlights a critical RCE via unsafe deserialization (CVE-2026-59285) and an AI tool-calling privilege escalation (CVE-2026-59318), emphasizes widespread supply-chain exposure (reported 209,569 affected components) and recommends inventorying dependencies, reviewing SBOMs, prioritizing internet-facing GraphQL and AI deployments, and upgrading to fixed versions.