Log in Start free

Vulnerability · Published Jun 9, 2026 · Assigned by vmware

CVE-2026-41844Spring Framework Open Redirect in Spring MVC and WebFlux

Medium 4.2

In plain English

A medium-severity open redirect in Spring Framework from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.1%top 96.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2026-41844
Debian:13libspring-javano fix listedDEBIAN-CVE-2026-41844
Debian:14libspring-javano fix listedDEBIAN-CVE-2026-41844
Mavenorg.springframework:spring-webflux6.2.19GHSA-h3qp-gqrc-q736
Mavenorg.springframework:spring-webfluxno fix listedGHSA-h3qp-gqrc-q736
Mavenorg.springframework:spring-webfluxno fix listedGHSA-h3qp-gqrc-q736
Mavenorg.springframework:spring-webflux7.0.8GHSA-h3qp-gqrc-q736
Mavenorg.springframework:spring-webmvcno fix listedGHSA-h3qp-gqrc-q736
Mavenorg.springframework:spring-webmvc7.0.8GHSA-h3qp-gqrc-q736
Mavenorg.springframework:spring-webmvc6.2.19GHSA-h3qp-gqrc-q736
Mavenorg.springframework:spring-webmvcno fix listedGHSA-h3qp-gqrc-q736
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2026-41844
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2026-41844
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2026-41844

Affected products (as reported)

VendorProductVersions
Spring Spring Framework 7.0.0 – before 7.0.7.16.2.0 – before 6.2.18.16.1.0 – before 6.1.285.3.0 – before 5.3.49

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References