CLSA-2026-1793636127: TuxCare security update for org.springframework (10 CVEs)
Published Nov 2, 2026
·Updated
TuxCare rebuilt 7 org.springframework packages to address 10 CVEs. Fixed in 5.1.3.RELEASE-tuxcare.4.
Affected Software
7 affected componentsFixes available
tuxcare/org.springframework:spring-beans>=5.1.3.RELEASE<5.1.3.RELEASE-tuxcare.4
5.1.3.RELEASE-tuxcare.4
tuxcare/org.springframework:spring-core>=5.1.3.RELEASE<5.1.3.RELEASE-tuxcare.4
5.1.3.RELEASE-tuxcare.4
tuxcare/org.springframework:spring-expression>=5.1.3.RELEASE<5.1.3.RELEASE-tuxcare.4
5.1.3.RELEASE-tuxcare.4
tuxcare/org.springframework:spring-web>=5.1.3.RELEASE<5.1.3.RELEASE-tuxcare.4
5.1.3.RELEASE-tuxcare.4
tuxcare/org.springframework:spring-webflux>=5.1.3.RELEASE<5.1.3.RELEASE-tuxcare.4
5.1.3.RELEASE-tuxcare.4
tuxcare/org.springframework:spring-webmvc>=5.1.3.RELEASE<5.1.3.RELEASE-tuxcare.4
5.1.3.RELEASE-tuxcare.4
tuxcare/org.springframework:spring-websocket>=5.1.3.RELEASE<5.1.3.RELEASE-tuxcare.4
5.1.3.RELEASE-tuxcare.4
Event History
Nov 2, 2026
Advisory Published
via OSV·05:15 PM
Data Sourced
via OSV·05:15 PM
DescriptionAffected Software
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
1
Which components are included in this update?
The update rebuilds seven org.springframework packages: spring-beans, spring-core, spring-expression, spring-web, spring-webflux, spring-webmvc, and spring-websocket.
2
What fixed package release should be deployed?
The stated fixed release is 5.1.3.RELEASE-tuxcare.4.