Broadcom Security Advisories: June 2026 — Broadcom Security Advisories

GHSA-j388-8rm5-p97f

Cloud Foundry / TanzuPoC exploitHIGH2026-06-10

GHSA-j388-8rm5-p97f

CVEs:GHSA-j388-8rm5-p97f

Upstream advisory

GHSA-2827-2mxx-j8pv

Cloud Foundry / TanzuPoC exploitHIGH2026-06-09

Spring Retry has Cache Exhaustion in Stateful Retries that leads to Denial of Service

CVEs:GHSA-2827-2mxx-j8pv

Upstream advisory

GHSA-792x-6vq6-j8r9

Cloud Foundry / TanzuPoC exploitHIGH2026-06-11

Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem

CVEs:GHSA-792x-6vq6-j8r9

Upstream advisory

GHSA-g3pr-3p32-fp23

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-09

Micrometer HTTP server instrumentations DoS

CVEs:GHSA-g3pr-3p32-fp23

Upstream advisory

GHSA-w737-wx49-qj23

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-09

Micrometer gRPC server instrumentation DoS

CVEs:GHSA-w737-wx49-qj23

Upstream advisory

GHSA-xq69-5h5v-x9x4

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-10

In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

CVEs:GHSA-xq69-5h5v-x9x4

Upstream advisory

GHSA-px92-q6rc-6mwv

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-11

GHSA-px92-q6rc-6mwv

CVEs:GHSA-px92-q6rc-6mwv

Upstream advisory

GHSA-85qj-f5wg-rwp9

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-23

GHSA-85qj-f5wg-rwp9

CVEs:GHSA-85qj-f5wg-rwp9

Upstream advisory

GHSA-x23c-287f-qqv5

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-09

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

CVEs:GHSA-x23c-287f-qqv5

Upstream advisory

GHSA-9cjf-w9mw-93r3

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-02

GHSA-9cjf-w9mw-93r3

CVEs:GHSA-9cjf-w9mw-93r3

Upstream advisory

GHSA-whpp-xv3h-rwxf

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-11

GHSA-whpp-xv3h-rwxf

CVEs:GHSA-whpp-xv3h-rwxf

Upstream advisory

GHSA-5x25-c2rf-f2jx

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-11

GHSA-5x25-c2rf-f2jx

CVEs:GHSA-5x25-c2rf-f2jx

Upstream advisory

GHSA-9fw2-h3hf-293r

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-10

GHSA-9fw2-h3hf-293r

CVEs:GHSA-9fw2-h3hf-293r

Upstream advisory

GHSA-r5w3-xv2f-j59q

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-09

Spring Framework Algorithmic Denial of Service via SpEL Expressions

CVEs:GHSA-r5w3-xv2f-j59q

Upstream advisory

GHSA-wxpp-56q6-5pcg

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-09

Spring Framework Denial of Service via Unbounded Cache in SpEL

CVEs:GHSA-wxpp-56q6-5pcg

Upstream advisory

GHSA-2mpf-m756-hxjm

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-11

GHSA-2mpf-m756-hxjm

CVEs:GHSA-2mpf-m756-hxjm

Upstream advisory

GHSA-phxq-526m-79px

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-11

GHSA-phxq-526m-79px

CVEs:GHSA-phxq-526m-79px

Upstream advisory

GHSA-gg69-9wwp-6jx2

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-10

GHSA-gg69-9wwp-6jx2

CVEs:GHSA-gg69-9wwp-6jx2

Upstream advisory

GHSA-qc5f-2h9q-7m2g

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-02

GHSA-qc5f-2h9q-7m2g

CVEs:GHSA-qc5f-2h9q-7m2g

Upstream advisory

GHSA-72pg-x5f8-j25j

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-09

Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux

CVEs:GHSA-72pg-x5f8-j25j

Upstream advisory

GHSA-5m4m-73w9-8433

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-10

GHSA-5m4m-73w9-8433

CVEs:GHSA-5m4m-73w9-8433

Upstream advisory

GHSA-m69x-pw9p-7j3q

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-10

GHSA-m69x-pw9p-7j3q

CVEs:GHSA-m69x-pw9p-7j3q

Upstream advisory

GHSA-5whc-4q84-fj73

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-10

GHSA-5whc-4q84-fj73

CVEs:GHSA-5whc-4q84-fj73

Upstream advisory

GHSA-659m-px2c-25wj

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-09

Spring Framework Denial of Service via AntPathMatcher

CVEs:GHSA-659m-px2c-25wj

Upstream advisory

GHSA-mq64-j8f9-9gcj

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-09

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

CVEs:GHSA-mq64-j8f9-9gcj

Upstream advisory

GHSA-cv39-x4c6-hhp2

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-10

GHSA-cv39-x4c6-hhp2

CVEs:GHSA-cv39-x4c6-hhp2

Upstream advisory

GHSA-cmwh-w62w-r2mf

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-15

GHSA-cmwh-w62w-r2mf

CVEs:GHSA-cmwh-w62w-r2mf

Upstream advisory

GHSA-439x-6767-44cv

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-09

Spring HATEOAS heap exhaustion through unbounded internal caching

CVEs:GHSA-439x-6767-44cv

Upstream advisory

GHSA-xvfq-4q6q-gxx7

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

CVEs:GHSA-xvfq-4q6q-gxx7

Upstream advisory

GHSA-5vpf-xvv7-c8vh

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-10

GHSA-5vpf-xvv7-c8vh

CVEs:GHSA-5vpf-xvv7-c8vh

Upstream advisory

GHSA-26m2-9g2q-v45q

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-15

GHSA-26m2-9g2q-v45q

CVEs:GHSA-26m2-9g2q-v45q

Upstream advisory

GHSA-7fxc-486f-32q9

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-09

Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

CVEs:GHSA-7fxc-486f-32q9

Upstream advisory

GHSA-x863-p983-p4f7

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-09

GHSA-x863-p983-p4f7

CVEs:GHSA-x863-p983-p4f7

Upstream advisory

GHSA-775g-4xr8-78h8

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-09

Spring Framework Denial of Service via Integer Overflow in SpEL Expressions

CVEs:GHSA-775g-4xr8-78h8

Upstream advisory

GHSA-hc43-m36c-8v33

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

GHSA-hc43-m36c-8v33

CVEs:GHSA-hc43-m36c-8v33

Upstream advisory

GHSA-jrv5-8w28-4265

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-09

Spring LDAP has Authentication Bypass with Empty Password

CVEs:GHSA-jrv5-8w28-4265

Upstream advisory

GHSA-83f7-v6px-pp3h

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-09

Spring Framework Denial of Service via Multipart Requests in WebFlux

CVEs:GHSA-83f7-v6px-pp3h

Upstream advisory

GHSA-f9p6-prpf-3757

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-04

GHSA-f9p6-prpf-3757

CVEs:GHSA-f9p6-prpf-3757

Upstream advisory

GHSA-53w6-v7cv-fc9h

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

GHSA-53w6-v7cv-fc9h

CVEs:GHSA-53w6-v7cv-fc9h

Upstream advisory

GHSA-8h76-qw8h-fmjh

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-01

GHSA-8h76-qw8h-fmjh

CVEs:GHSA-8h76-qw8h-fmjh

Upstream advisory

GHSA-gg9r-wr4p-w63h

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-11

GHSA-gg9r-wr4p-w63h

CVEs:GHSA-gg9r-wr4p-w63h

Upstream advisory

GHSA-8r2h-xh92-gq57

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

GHSA-8r2h-xh92-gq57

CVEs:GHSA-8r2h-xh92-gq57

Upstream advisory

GHSA-9ggw-87m9-9gfc

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-11

GHSA-9ggw-87m9-9gfc

CVEs:GHSA-9ggw-87m9-9gfc

Upstream advisory

GHSA-8qq9-r6cc-qjv9

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-11

GHSA-8qq9-r6cc-qjv9

CVEs:GHSA-8qq9-r6cc-qjv9

Upstream advisory

GHSA-6rpq-6vv2-5222

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

GHSA-6rpq-6vv2-5222

CVEs:GHSA-6rpq-6vv2-5222

Upstream advisory

GHSA-x2r2-rvhq-2mqv

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

GHSA-x2r2-rvhq-2mqv

CVEs:GHSA-x2r2-rvhq-2mqv

Upstream advisory

GHSA-x4h3-g2x4-8gqv

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-01

Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry

CVEs:GHSA-x4h3-g2x4-8gqv

Upstream advisory

GHSA-x9c7-5h6g-hq8q

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-01

Spring Cloud Function Context has Uncontrolled Recursion

CVEs:GHSA-x9c7-5h6g-hq8q

Upstream advisory

GHSA-xg2j-3hj6-pc24

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

GHSA-xg2j-3hj6-pc24

CVEs:GHSA-xg2j-3hj6-pc24

Upstream advisory

GHSA-3pjj-qpw6-5fcm

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-10

GHSA-3pjj-qpw6-5fcm

CVEs:GHSA-3pjj-qpw6-5fcm

Upstream advisory

GHSA-hw5c-xm3c-v96w

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-11

GHSA-hw5c-xm3c-v96w

CVEs:GHSA-hw5c-xm3c-v96w

Upstream advisory

GHSA-2q7c-5gjm-7q23

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-10

GHSA-2q7c-5gjm-7q23

CVEs:GHSA-2q7c-5gjm-7q23

Upstream advisory

GHSA-p5mm-xwgq-whfr

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

GHSA-p5mm-xwgq-whfr

CVEs:GHSA-p5mm-xwgq-whfr

Upstream advisory

GHSA-4hfh-6x8g-gwpp

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-09

Spring Framework Escalation via Session Fixation in WebFlux

CVEs:GHSA-4hfh-6x8g-gwpp

Upstream advisory

GHSA-mwpv-rg79-863c

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

GHSA-mwpv-rg79-863c

CVEs:GHSA-mwpv-rg79-863c

Upstream advisory

GHSA-m39w-hqxx-3r48

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-11

GHSA-m39w-hqxx-3r48

CVEs:GHSA-m39w-hqxx-3r48

Upstream advisory

GHSA-cjpg-rgq5-fr37

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-09

Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux

CVEs:GHSA-cjpg-rgq5-fr37

Upstream advisory

GHSA-9f52-rjqv-25qv

Cloud Foundry / TanzuCoalition ESS < 30%LOW2026-06-09

Spring Framework Arbitrary Method Invocation in SpEL Expressions

CVEs:GHSA-9f52-rjqv-25qv

Upstream advisory

GHSA-p5f7-rjhp-pxvc

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

GHSA-p5f7-rjhp-pxvc

CVEs:GHSA-p5f7-rjhp-pxvc

Upstream advisory

GHSA-4r8w-73jc-3m7q

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

GHSA-4r8w-73jc-3m7q

CVEs:GHSA-4r8w-73jc-3m7q

Upstream advisory

GHSA-pfc9-2cqg-9wq6

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-09

Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect

CVEs:GHSA-pfc9-2cqg-9wq6

Upstream advisory

GHSA-q723-847q-5g8g

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-09

Spring Framework Predictable Session ID in WebSocket Module

CVEs:GHSA-q723-847q-5g8g

Upstream advisory

GHSA-xhf5-x86m-mrgw

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-18

GHSA-xhf5-x86m-mrgw

CVEs:GHSA-xhf5-x86m-mrgw

Upstream advisory

GHSA-vqgp-pf68-6947

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-09

Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL

CVEs:GHSA-vqgp-pf68-6947

Upstream advisory

GHSA-3chg-m5w7-qfv5

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-09

Spring Framework Cross-site Scripting via JavaScriptUtils

CVEs:GHSA-3chg-m5w7-qfv5

Upstream advisory

GHSA-6mfm-98wv-32wm

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-11

GHSA-6mfm-98wv-32wm

CVEs:GHSA-6mfm-98wv-32wm

Upstream advisory

GHSA-957g-f97v-vppc

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-09

Spring Framework Cross-site Scripting via JSP Form Tags

CVEs:GHSA-957g-f97v-vppc

Upstream advisory

GHSA-hf28-w9wf-5x8m

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-15

GHSA-hf28-w9wf-5x8m

CVEs:GHSA-hf28-w9wf-5x8m

Upstream advisory

GHSA-ww38-37g9-m3q3

Cloud Foundry / TanzuCoalition ESS < 30%LOW2026-06-10

GHSA-ww38-37g9-m3q3

CVEs:GHSA-ww38-37g9-m3q3

Upstream advisory

GHSA-h3qp-gqrc-q736

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-09

Spring Framework Open Redirect in Spring MVC and WebFlux

CVEs:GHSA-h3qp-gqrc-q736

Upstream advisory

GHSA-p8qj-fj6r-w7q9

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

GHSA-p8qj-fj6r-w7q9

CVEs:GHSA-p8qj-fj6r-w7q9

Upstream advisory

GHSA-wx8w-j86h-c458

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-11

GHSA-wx8w-j86h-c458

CVEs:GHSA-wx8w-j86h-c458

Upstream advisory

GHSA-p7qj-2q5w-f9r7

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-11

GHSA-p7qj-2q5w-f9r7

CVEs:GHSA-p7qj-2q5w-f9r7

Upstream advisory

GHSA-9wxp-w4px-32vh

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-11

GHSA-9wxp-w4px-32vh

CVEs:GHSA-9wxp-w4px-32vh

Upstream advisory

GHSA-7m2p-62gw-p8qq

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-09

Spring Framework Server-Side Request Forgery via UriComponentsBuilder

CVEs:GHSA-7m2p-62gw-p8qq

Upstream advisory

GHSA-gmvv-r68v-m7x9

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-04

GHSA-gmvv-r68v-m7x9

CVEs:GHSA-gmvv-r68v-m7x9

Upstream advisory

GHSA-293q-567p-wmwq

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-10

Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

CVEs:GHSA-293q-567p-wmwq

Upstream advisory

GHSA-96vc-39m3-22w5

Cloud Foundry / TanzuCoalition ESS < 30%CRITICAL2026-06-04

GHSA-96vc-39m3-22w5

CVEs:GHSA-96vc-39m3-22w5

Upstream advisory

GHSA-cggw-g858-xx4w

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-04

GHSA-cggw-g858-xx4w

CVEs:GHSA-cggw-g858-xx4w

Upstream advisory

GHSA-ggg2-9786-hwc8

Cloud Foundry / TanzuCoalition ESS < 30%MEDIUM2026-06-11

GHSA-ggg2-9786-hwc8

CVEs:GHSA-ggg2-9786-hwc8

Upstream advisory

GHSA-fqm2-p6px-f54c

Cloud Foundry / TanzuCoalition ESS < 30%HIGH2026-06-04

GHSA-fqm2-p6px-f54c

CVEs:GHSA-fqm2-p6px-f54c

Upstream advisory

What would you fix first?

Advisories

Need live exploit intelligence?