[Aikido] Fix 18 security issues in spring-core, spring-webmvc, spring-web and 8 more

[aikido-autofix]

Upgrade Spring and Jetty dependencies to fix critical SSRF/open redirect vulnerabilities in URL parsing, Digest authentication bypass via character encoding collision, and HTTP request smuggling via malformed chunk extensions.

⚠️ Breaking changes analysis not available for: org.eclipse.jetty:jetty-server, org.eclipse.jetty:jetty-http, org.jetbrains.kotlin:kotlin-stdlib

✅ No breaking changes for: org.springframework:spring-core, org.springframework:spring-webmvc, org.springframework:spring-web, org.springframework:spring-beans, org.springframework:spring-expression, org.springframework:spring-context, org.eclipse.jetty:jetty-security, io.netty:netty-codec-http2

✅ 18 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2024-22262	HIGH	[spring-core] UriComponentsBuilder fails to properly parse externally provided URLs, allowing attackers to bypass host validation checks and perform open redirect or SSRF attacks.
CVE-2024-22243	HIGH	[spring-core] UriComponentsBuilder fails to properly validate URLs parsed from external input, allowing attackers to bypass host validation checks and potentially perform open redirect or SSRF attacks.
CVE-2024-22259	HIGH	[spring-core] UriComponentsBuilder fails to properly parse externally provided URLs, allowing attackers to bypass host validation checks and conduct open redirect or SSRF attacks.
CVE-2025-41249	MEDIUM	[spring-core] Spring Framework's annotation detection may fail to resolve security annotations on methods in generic superclasses, potentially bypassing authorization checks when using Spring Security's @EnableMethodSecurity feature.
CVE-2024-38820	MEDIUM	[spring-core] The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
CVE-2026-41848	LOW	[spring-core] A Regular Expression Denial of Service (ReDoS) vulnerability exists in AntPathMatcher methods that process user-supplied patterns, allowing attackers to cause application hangs or crashes through malicious regex patterns.
AIKIDO-2024-10361	LOW	[spring-core] A locale-dependent case sensitivity flaw in string handling allows attackers to bypass security checks by exploiting inconsistent case conversion across different locales. This vulnerability can lead to improper field protection and unauthorized access to restricted functionality.
CVE-2024-38809	LOW	[spring-core] ETag parsing from "If-Match" or "If-None-Match" request headers is vulnerable to denial of service attacks through unbounded header processing.
CVE-2026-10050	HIGH	[jetty-security] Digest authentication in the HTTP client uses ISO-8859-1 encoding when computing response hashes, which silently converts non-Latin-1 characters (Chinese, Japanese, Cyrillic, etc.) to ?, allowing attackers to bypass authentication by replacing such characters with ? to produce identical hash collisions.
CVE-2026-2332	HIGH	[jetty-server] The HTTP/1.1 parser incorrectly handles chunk extensions with unclosed quoted strings, terminating parsing at \r\n instead of treating it as an error, enabling HTTP request smuggling attacks. This allows attackers to inject malicious requests that bypass security controls.
CVE-2025-11143	MEDIUM	[jetty-server] URI parser interprets invalid or unusual URIs differently than other common parsers, potentially allowing security bypasses when multiple components parse URIs inconsistently or disclosing implementation details through differential parsing behavior.
CVE-2024-6763	MEDIUM	[jetty-server] Insufficient validation of URI authority segments in HttpURI can cause host extraction discrepancies between Jetty and browsers, enabling open redirect or SSRF attacks when combined with vulnerable browsers.
CVE-2026-6790	MEDIUM	[jetty-server] Request authority and Host header mismatch is not strictly validated, allowing attackers to manipulate URI construction, virtual host selection, and reverse proxying, potentially leading to security bypasses and spoofing attacks.
AIKIDO-2026-739270	HIGH	[netty-codec-http2] HTTP/2 content decompression leaks direct ByteBuf memory when DATA frames are sent on closed decompressor channels, allowing remote attackers to exhaust memory and cause DoS via repeated requests on long-lived connections.
AIKIDO-2026-11158	HIGH	[spring-core] Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.
AIKIDO-2026-10571	MEDIUM	[spring-core] Static resource handling on Windows is vulnerable to uncontrolled resource consumption when resolving crafted requests, allowing attackers to exhaust HTTP connections and cause denial of service.
AIKIDO-2024-10363	LOW	[spring-core] A locale-dependent case sensitivity flaw in string handling allows attackers to bypass security checks by exploiting inconsistent case conversion across different locales. This vulnerability can lead to improper field protection and unauthorized access to restricted functionality.
AIKIDO-2026-550292	MEDIUM	[kotlin-stdlib] In JetBrains Kotlin, a vulnerable Java API is used for temporary file and folder creation. An attacker is able to read data from such files and list directories due to insecure permissions.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-16465
• https://aikido.atlassian.net/browse/AIK-17872

[aikido-pr-checks]

CVE-2026-10051 in Eclipse Jetty - medium severity
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.
Subsequent request that do not have trailers report the trailers of the first request.
Subsequent request that do have trailers report the union of trailers of the first request and the current request.

Details

Remediation Aikido suggests bumping this package to version 12.0.36 to resolve this issue

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}