91 Spring CVEs: The AI Vulnerability Consumption Problem

Broadcom published a broad August 20, 2026 security advisory covering numerous high-severity vulnerabilities across Spring and related projects (Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Reactor, and others), including insecure deserialization, potential untrusted code execution, SSRF, path traversal, information exposure, and DoS; the disclosure highlights the large remediation burden across the software supply chain and observes that AI is accelerating vulnerability discovery faster than downstream remediation can absorb.