8.0High
CVE-2026-47873Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces
Description
The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
Weakness (CWE):
CWE-1327
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| broadcom | spring tools | < 5.3.0 | |
| Spring | Spring Tools for Eclipse | ≤ 5.2.0 |
References and patches
- https://spring.io/security/cve-2026-47873 Vendor Advisory
CPE matches (NVD) (1)
cpe:2.3:a:broadcom:spring_tools:*:*:*:*:*:eclipse:*:*< 5.3.0