Snyk False Positives: Addressing CVE Flags in Spring Boot 3.5.17 Dependencies

Products

• VMware Tanzu Application Platform

Issue/Introduction

Automated security scanners, specifically Snyk, may flag various vulnerabilities in Spring Boot 3.5.17 as "High" or "Critical" severity. These flags appear despite the application running on Spring Boot 3.5.17, which contains the remediated Spring Framework version 6.2.20.

This situation creates a discrepancy between security scan reports and the actual risk profile of the application, as the vulnerabilities reported are already resolved in the framework version included within the Spring Boot release.

Impacted CVEs: The following CVEs are among those incorrectly flagged by Snyk despite the presence of the fix in Spring Framework 6.2.20:

• https://spring.io/security/cve-2026-47884 
• https://spring.io/security/cve-2026-59281  
• https://spring.io/security/cve-2026-59283  
• https://spring.io/security/cve-2026-47886  
• https://spring.io/security/cve-2026-47889  
• https://spring.io/security/cve-2026-59282  
• https://spring.io/security/cve-2026-47885  
• https://spring.io/security/cve-2026-47883  
• https://spring.io/security/cve-2026-47887  
• https://spring.io/security/cve-2026-59314  
• https://spring.io/security/cve-2026-47890  
• https://spring.io/security/cve-2026-59313  

Environment

 Spring Boot, Spring Enterprise Subscription Framework: Spring Boot 3.5.17 (incorporating Spring Framework 6.2.20)

Resolution

 

Spring Boot 3.5.17 incorporates Spring Framework 6.2.20, which contains the definitive fixes for the CVEs listed above. The discrepancies in Snyk’s reporting are known false positives arising from how the scanner detects the vulnerability versus the actual patched state of the framework.

Recommended Actions:

1. Verify Your Version: Ensure your application is successfully building with Spring Boot 3.5.17. You can verify this by checking your dependency management report:

   • Maven: 

     ./mvnw dependency:list -DincludeGroupIds=org.springframework -DincludeScope=runtime

• • Gradle: 

    ./gradlew dependencies --configuration runtimeClasspath | grep org.springframework

1. • Confirm that spring-framework components are at version 6.2.20.

2. Report the False Positive to Snyk: Broadcom is actively working with Snyk to correct these detection discrepancies. If these flags are impacting your compliance or security reporting, please contact Snyk Support directly. Providing the official Spring Security advisory links above can help Snyk expedite the correction of these false-positive flags in their database.

3. Document the Finding: If you are required to provide a justification for security compliance, reference this article and the official Spring Security Advisories for the specific CVEs, noting that the fixes are natively included in the Spring Framework 6.2.20 version utilized by your application.

References

• Official Spring Security Advisories