Database Management

Why SolarWinds Database Performance Analyzer (DPA) is not affected by multiple Spring vulnerabilities

This article explains why SolarWinds Database Performance Analyzer (DPA) is not affected by multiple Spring vulnerabilities. CVE-2026-47885 CVE-2026-47893 CVE-2026-47886 CVE-2026-47887 CVE-2026-59281 CVE-2026-59280 CVE-2026-47888

First published date

10/22/2026 1:20 PM

Last published date

10/22/2026 1:20 PM

Overview

In 2026, the National Institute of Standards and Technology (NIST) published security bulletins about the following vulnerabilities:

Product section

Database Performance Analyzer

Cause

CVE-2026-47885: The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1.

CVE-2026-47893: A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason.

CVE-2026-47886: Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value.

CVE-2026-47887: A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path and does not have a configured prefix is vulnerable to an open redirect.

CVE-2026-59281: Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability.

CVE-2026-59280: Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader.

CVE-2026-47888: A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame.

Resolution

SolarWinds Database Performance Analyzer (DPA) is not affected by CVE-2026-47885, CVE-2026-47893, CVE-2026-47886, CVE-2026-47887, CVE-2026-59281, CVE-2026-59280, and CVE-2026-47888.

CVE-2026-47885 and CVE-2026-47893: DPA does not use the vulnerable component, spring-webflux, therefore is not affected by this vulnerability.

CVE-2026-47886: DPA never evaluates SpEL expressions supplied by user, so the vulnerable code path cannot be triggered.

CVE-2026-47887: The specific controller class, UrlFileNameViewController, is never instantiated or configured in DPA.

CVE-2026-59281: This vulnerability requires all the following conditions to be considered at risk: must obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors in JSP/HTML view. DPA does not match these conditions.

CVE-2026-59280: DPA does not use the vulnerable component, SpringTemplateLoader, therefore is not impacted by this vulnerability.

CVE-2026-47888: DPA does not use the vulnerable component, RSocket, therefore is not impacted by vulnerability.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.