Log in Start free

Vulnerability · Published Jun 9, 2026 · Assigned by vmware

CVE-2026-41838Spring Framework Predictable Session ID in WebSocket Module

Medium 4.8

In plain English

A medium-severity weak randomness in Spring Framework from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 93.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2026-41838
Debian:13libspring-javano fix listedDEBIAN-CVE-2026-41838
Debian:14libspring-javano fix listedDEBIAN-CVE-2026-41838
Mavenorg.springframework:spring-websocketno fix listedGHSA-q723-847q-5g8g
Mavenorg.springframework:spring-websocket7.0.8GHSA-q723-847q-5g8g
Mavenorg.springframework:spring-websocket6.2.19GHSA-q723-847q-5g8g
Mavenorg.springframework:spring-websocketno fix listedGHSA-q723-847q-5g8g
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2026-41838
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2026-41838
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2026-41838

Affected products (as reported)

VendorProductVersions
Spring Spring Framework 7.0.0 – before 7.0.7.16.2.0 – before 6.2.18.16.1.0 – before 6.1.285.3.0 – before 5.3.49

Weakness: CWE-330 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

References