org.springframework.grpc:spring-grpc (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.springframework.grpc:spring-grpc, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2026-40968 — CVSS 4.2 (medium): When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can…
• CVE-2026-40969 — CVSS 3.7 (low): The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status…