CVE-2013-6429: The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC...

Security readout for executives and security teams

This issue affects older Spring MVC applications that process XML. A crafted XML request may let an attacker read files from the server, trigger denial of service, or cause CSRF-style behavior. The source bundle does not provide CVSS scoring or evidence of active exploitation. Exposure is most likely in legacy Java web applications using affected Spring Framework/Spring MVC versions and accepting XML request bodies handled by SourceHttpMessageConverter. Prioritize remediation for internet-facing or partner-facing XML endpoints on legacy Spring MVC. The business risk is unauthorized file disclosure and service disruption, but urgency is moderated by no KEV listing or cited active exploitation. Mitigation focus: Upgrade affected Spring Framework deployments to a vendor-supported, non-vulnerable release.; Confirm vendor guidance for exact fixed versions in your Spring release line.; Reduce XML parsing exposure where XML request bodies are not required..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.