Page 1 of 1
[Solved] org.springframework:spring-web.5.3.31 vulnerability
Posted: Tue Apr 28, 2026 1:59 pm
by jligotino
Running Unimus in GCP on Ubuntu. Got this CVE warning: CVE-2016-1000027. org.springframework:spring-web.5.3.31 should be upgraded to version 6.0.0. Has anyone encountered this and have they upgraded to 6.0.0?
Re: org.springframework:spring-web.5.3.31 vulnerability
Posted: Wed Apr 29, 2026 1:03 pm
by Tommy.c
I am bugging the devs about this right now. Should have an answer in a little bit.
There's been a wave of CVE stuff recently with a lot of the packages we utilize. So far it's been 100% okay to update, but I want to double check before I say yes.
Re: org.springframework:spring-web.5.3.31 vulnerability
Posted: Thu Apr 30, 2026 2:31 pm
by Tommy.c
Okay, spring framework is really important to the Unimus UI. Updating it or possibly just the web portion might be possible, but there are a lot of dependencies we rely on and it's hairy.
We are looking into options and if we have work arounds or mitigations I will report back here.
Re: org.springframework:spring-web.5.3.31 vulnerability
Posted: Fri May 01, 2026 3:33 am
by Tomas
Unimus is
NOT affected by this issue / CVE.
This is an old CVE (from 2016) that was republished against a newer version of Spring this month for some reason - not officially by Spring. You can see more info here:
https://github.com/spring-projects/spri ... -579669626
We do NOT use nor expose HTTP Invoker endpoints, and as such Unimus should not be considered vulnerable. As Tommy mentioned, the Spring Web framework is a foundational component of Unimus. I can't be upgraded easily - basically requires a whole lot of migration rewrites to migrate to v6.
We will see what we can do, if there is an easier way for Unimus to not get flagged by scanners. But as I mentioned, we / you are not affected
