[jira] [Resolved] (FINERACT-2962) Upgrade Spring Boot to 4.1.1 to fix CVE-2026-47884 and CVE-2026-47890

["Adam Saghy (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/FINERACT-2962?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Adam Saghy resolved FINERACT-2962.
----------------------------------
      Assignee: Jose Alberto Hernandez Maldonado
    Resolution: Fixed

> Upgrade Spring Boot to 4.1.1 to fix CVE-2026-47884 and CVE-2026-47890
> ---------------------------------------------------------------------
>
>                 Key: FINERACT-2962
>                 URL: https://issues.apache.org/jira/browse/FINERACT-2962
>             Project: Apache Fineract
>          Issue Type: Task
>            Reporter: Jose Alberto Hernandez
>            Assignee: Jose Alberto Hernandez Maldonado
>            Priority: Major
>              Labels: security
>             Fix For: 1.16.0
>
>
> *Background*
> {\{develop}} is on Spring Boot 4.1.0, which brings Spring Framework 7.0.8. Two CVEs published on 2026-08-20 affect \{{spring-webmvc}} 7.0.0 - 7.0.8 and are fixed in Spring Framework 7.0.9, which ships with Spring Boot 4.1.1:
> * *CVE-2026-47884*: RCE/SSRF via \{{XsltView}} ([https://spring.io/security/cve-2026-47884])
> * *CVE-2026-47890*: SSE stream corruption with view fragments ([https://spring.io/security/cve-2026-47890])
> *Problem / Motivation*
> Container scanners (e.g. Trivy, which uses the GHSA score) flag both CVEs as CRITICAL (CVSS 9.8). Spring rates them 5.8 and 2.6. Images built from \{{develop}} therefore fail any CVSS >= 9 gate.
> Fineract does not appear to be exploitable: \{{spring-webmvc}} is on the classpath (\{{spring-boot-starter-webmvc}}, springdoc) and Spring MVC serves the Thymeleaf login page (\{{LoginController}}), but the codebase has no use of \{{XsltView}}, \{{SseEmitter}}, \{{FragmentsRendering}} or \{{ModelAndView}}, which are the preconditions of both CVEs. The REST API itself is served by Jersey. This is a code search, not an exploitability analysis.
> The upgrade is not a version bump only. Spring Boot 4.1.1 changed the signature of \{{JpaBaseConfiguration#entityManagerFactoryBuilder}}: the last parameter \{{Map<String, AsyncTaskExecutor> taskExecutors}} was replaced by \{{ListableBeanFactory beanFactory}}. \{{JPAConfig}} overrides that method, so \{{develop}} does not compile against 4.1.1 until the override is adapted.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)