CVE-2016-1000027 Pivotal Spring Framework contains unsafe Java deserialization methods
Remote code execution is possible in Spring Framework if developers configure it to deserialize untrusted data, a scenario the vendor deems out of scope.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-1000027?
CVE-2016-1000027 is a critical unsafe deserialization vulnerability in Vmware Spring Framework, published on 2 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
Weakness: CWE-502
Which versions are affected by CVE-2016-1000027?
2 open source packages ship an affected version, including org.springframework:spring-web. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework:spring-web Maven | All versions | 6.0.0 |
org.springframework:spring-web Maven | All versions | 6.0.0 |
Products include Vmware Spring Framework.
How do I fix CVE-2016-1000027?
Upgrade org.springframework:spring-web to 6.0.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2016-1000027 being exploited?
There is no known exploitation of CVE-2016-1000027 in the wild and no public exploit code.
Public exploit code: 4 proofs of concept on GitHub.
Other vulnerabilities in Vmware Spring Framework
- CVE-2026-47884 Spring Framework Improper Path Limitation in XsltView
- CVE-2026-47890 Spring Framework Server Sent Event stream corruption while rendering fragments
- CVE-2026-47891 Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
- CVE-2026-47892 Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
- CVE-2026-59313 Server Sent Event stream corruption in Spring MVC functional web framework
Sources
Also known as CLEANSTART-2026-DY91786, DEBIAN-CVE-2016-1000027, GHSA-4wrc-f8pq-fpqp, MINI-564f-9jhg-rjwp, MINI-c7cw-gj96-v8hr, MINI-vccc-gfwj-g2mj and 2 more.