{"id":"CVE-2016-1000027","details":"Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.","aliases":["GHSA-4wrc-f8pq-fpqp"],"modified":"2026-04-11T19:41:56.801030Z","published":"2020-01-02T23:15:11.857Z","related":["CGA-q3qw-6q76-5vgr"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2016-1000027"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20230420-0009/"},{"type":"ADVISORY","url":"https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027"},{"type":"REPORT","url":"https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626"},{"type":"REPORT","url":"https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417"},{"type":"REPORT","url":"https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525"},{"type":"EVIDENCE","url":"https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000027.json"},{"type":"EVIDENCE","url":"https://www.tenable.com/security/research/tra-2016-20"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/spring-projects/spring-framework","events":[{"introduced":"0"},{"fixed":"5a30a43b753a971ac8bf4005a8ccddeaff439d7e"}],"database_specific":{"cpe":"cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"6.0.0"}],"source":"CPE_FIELD"}}],"versions":["v3.2.0.M1","v3.2.0.M2","v3.2.0.RC1","v3.2.0.RC2-A","v3.2.0.RELEASE","v4.0.0.M1","v4.0.0.M2","v4.0.0.M3","v4.0.0.RC1","v4.0.0.RC2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-1000027.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}