xiaoqimikko/spring-cvss-checkScans Java artifacts and source for Spring/Tomcat CVEs, compares vendor vs NVD CVSS scores, verifies exploitability conditions, and checks if fix versions exist on Maven Central.
Covers 15 official Spring / Tomcat security advisories (seven from 2026-08-20 · five from 2026-06-08 · one from 2025-09-15 · two Tomcat from 2026-08-25).
For 8 of them, scanners pulling from NVD report CRITICAL 9.1~9.8, while the vendor's official rating is LOW / MEDIUM.
For the other 7, both sides rate them identically — the only difference: whether the vendor submitted a CVSS score for the CVE record themselves.
This tool answers four questions:
The open-source line of Spring 5.3 stopped at 5.3.39; later versions are only available to commercial customers. But searching
spring-core:5.3.4* on Maven Central turns up one: net.xdob.springframework (released 2025-03, 23 artifacts).
Item-by-item verification (2026-09-14):
| Item | Reading | How to verify |
|---|---|---|
| Origin | The POM's scm points to github.com/dibyang/spring-framework (a fork of the official repo), while developers still lists the official maintainers | Open the .pom on Central |
| Source | The head of the official 5.3.x branch is v5.3.39; the fork has 6 commits on top of it, only 1 of which changes Java: fix CVE-2024-38819 | gh api repos/spring-projects/spring-framework/compare/5.3.x...dibyang:spring-framework:5.3.x |
| Bytecode | spring-core's 978 classes and spring-context's 892 classes are byte-for-byte identical to official 5.3.39; spring-webmvc / spring-webflux each differ by only 1 class | Per-class SHA-256 of both jars |
| What official 5.3.41 fixed | Both CVE-2024-38819 and CVE-2024-38820 | spring.io/security/cve-2024-38819, -38820 |
| What this package fixed | Only 38819. The 38820 patch is in DataBinder, and its DataBinder is identical to 5.3.39's | This tool's bytecode verification |
Additionally, it leaves a debug line in Spring MVC's PathResourceLookupFunction.isInvalidPath:
System.out.println("path = " + path) — when serving static resources via the functional router RouterFunctions.resources(), every request path gets printed to stdout.
== Bytecode verification: version number says fixed, is the patch there ==
[MISMATCH] spring-context 5.3.41
Version number 5.3.41 should have fixed CVE-2024-38820 per the official advisory, but **this patch cannot be found** in DataBinder
[MISMATCH] spring-webmvc 5.3.41
Carries the net.xdob third-party recompile fingerprint: PathResourceLookupFunction.isInvalidPath contains a line System.out.println("path = " + path)
The criterion is not the version number, it's the patch itself: the official 38820 patch has two bytecode forms (from 6.1.14, toLowerCase(Locale.ROOT);
from 6.1.20, simpleMatchIgnoreCase). Before release, every open-source version on Central from 5.3.365.3.39, 6.0.206.0.23, and 6.1.10~6.1.21 was scanned:
before the fix, every version had neither form; after the fix, every version had at least one — zero false positives. Conclusions are only drawn for the 5.3 / 6.0 / 6.1 lines; 6.2 and later are not judged.
⚠️ Its 38819 patch differs from the official implementation (official 6.1.13 / 6.1.14 added isInvalidEncodedInputPath); whether the two are equivalent has not been verified by this tool.
| CVE | Component | Vendor official | NVD | Who assigned the score on NVD |
|---|---|---|---|---|
| CVE-2026-59313 | Spring Framework | LOW | 9.8 CRITICAL | CISA-ADP |
| CVE-2026-47890 | Spring Framework | LOW | 9.8 CRITICAL | CISA-ADP |
| CVE-2026-59283 | Spring Framework | MEDIUM | 9.1 CRITICAL | CISA-ADP |
| CVE-2026-47891 | Spring Framework | MEDIUM | 9.8 CRITICAL | CISA-ADP |
| CVE-2026-47884 | Spring Framework | MEDIUM | 9.8 CRITICAL | CISA-ADP |
| CVE-2026-47892 | Spring Framework | MEDIUM | 9.8 CRITICAL | CISA-ADP |
| CVE-2026-65637 | Apache Tomcat | Moderate | 9.8 CRITICAL | CISA-ADP |
| CVE-2026-65905 | Apache Tomcat | Low | 9.8 CRITICAL | CISA-ADP |
| CVE-2026-59270 | Spring Security | CRITICAL | 9.4 CRITICAL | Vendor self-assessed ✅ consistent |
The only one where both sides agree is precisely the one where the vendor submitted the CVSS score to NVD themselves.
The cause isn't anyone hiding anything: when the vendor doesn't submit a score, CISA-ADP automatically assigns one based on worst-case assumptions, and most SCA tools take that NVD number.
This isn't a bug — it's two scoring systems each using their own criteria — but your incident response process is running on 9.8.
Measured (with positive controls, re-run every time the rules table is generated):
spring-web 6.2.19 = 200 ← the previous version is on Central
spring-web 6.2.20 = 404 ← the one the vendor tells you to upgrade to, doesn't exist
spring-security-core 6.5.11 = 200
spring-security-core 6.5.12 = 404
In the vendor's Fix version table, these versions are marked Enterprise Support Only — available only to customers who purchased commercial support.
So if you're actually affected, your options are: upgrade across major versions, or buy commercial support.
java -jar spring-cvss-check.jar <jar|war|directory>... [--src <source directory>]
# Most common: scan build artifacts to determine versions, scan source to determine trigger conditions
java -jar spring-cvss-check.jar target/ --src src/main
# A single fat jar / war works too
java -jar spring-cvss-check.jar app.war
Requires JDK 17+. Zero runtime dependencies, no network access.
Exit codes: 0 no version hit (and every file was actually read) · 2 version hit but no trigger condition found · 3 trigger condition also met · 4 a file could not be read (see the "Exit codes" section at the end).
== Versions detected ==
Spring Framework 6.2.19 .../spring-core-6.2.19.jar
Spring Security 6.5.11 .../spring-security-core-6.5.11.jar
Apache Tomcat 9.0.37 .../tomcat-embed-core-9.0.37.jar
== 8 version hits ==
-- CVE-2026-47884 Spring Framework Improper Path Limitation in XsltView
Product Spring Framework Affected 6.2.0 - 6.2.19
[Discrepancy] Official **MEDIUM** <-> NVD **CRITICAL 9.8**
That score on NVD was not assigned by the vendor, it was assigned by CISA-ADP.
Trigger condition Only if XsltView is used, and a "/**" mapping that goes through view rendering exists, and the view name is not explicitly specified
[HIT] Found in your code/config:
src/main/java/demo/ReportView.java <- XsltView (line 2)
[Cannot upgrade] The vendor tells you to upgrade to 6.2.20 — **this version does not exist on Maven Central (404)**, marked Enterprise Support Only by the vendor
== Summary ==
Your scanner may report 7 of these 8 as CRITICAL;
while the **vendor official** ratings are: 3 LOW / 4 MEDIUM / 1 CRITICAL.
Of these 8, trigger conditions were not found in your source for 6, and were found for 2.
[!] For 7 of them, the official fixed version **does not exist on Maven Central at all**