CVE-2026-41846

🗓️ 09 Jun 2026 03:50:56Reported by vmwareType

Spring Framework permits cross-site scripting via JSP form tag attributes cssClass, cssErrorClass, and cssStyle.

Reporter	Title	Published	Views	Family All 64
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Information Disclosure, Denial of Service (Dos) attacks, and Path Traversal attacks	26 Jun 202618:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities identified in Spring Framework version shipped with IBM Guardium Cryptography Manager (GCM)	27 Aug 202612:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Controller	21 Jul 202603:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC [CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846]	27 Jul 202620:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in spring-webmvc jar	27 Jul 202607:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	30 Jun 202610:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	22 Jul 202607:55	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring MVC and WebFlux affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Spring MVC affects IBM Netezza Appliance	12 Aug 202608:48	–	ibm
Chainguard	CVE-2026-41846 vulnerabilities	31 Jul 202620:22	–	cgr

NVD

Vulners

Node

vmware spring_frameworkRange5.3.0–5.3.49

vmware spring_frameworkRange6.1.0–6.1.28

vmware spring_frameworkRange6.2.0–6.2.18.1

vmware spring_frameworkRange7.0.0–7.0.7.1

[
  {
    "vendor": "Spring",
    "product": "Spring Framework",
    "versions": [
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThan": "7.0.7.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.2.0",
        "lessThan": "6.2.18.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.1.0",
        "lessThan": "6.1.28",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.3.0",
        "lessThan": "5.3.49",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
spring	www.spring.io/security/cve-2026-41846

23 Jul 2026 08:10Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.15.9 - 6.1

EPSS0.00152

SSVC

CWE-79