Spring Framework Open Redirect in Spring MVC and WebFlux

🗓️ 09 Jun 2026 06:31:57Reported by GitHub Advisory DatabaseType

Spring Framework open redirect in MVC and WebFlux with catch-all mapping using redirect: without a view name.

Reporter	Title	Published	Views	Family All 72
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Information Disclosure, Denial of Service (Dos) attacks, and Path Traversal attacks	26 Jun 202618:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Controller	21 Jul 202603:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC [CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846]	27 Jul 202620:07	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Spring MVC and WebFlux affects IBM Netezza Appliance	12 Aug 202608:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in spring-webmvc jar	27 Jul 202607:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	30 Jun 202610:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	22 Jul 202607:55	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Software	20 Aug 202614:44	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring MVC and WebFlux affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:23	–	ibm
Chainguard	CVE-2026-41844 vulnerabilities	31 Jul 202620:22	–	cgr

Vulners

Node

org.springframework spring-webfluxRange≤5.3.39maven

org.springframework spring-webmvcRange≤5.3.39maven

org.springframework spring-webfluxRange6.1.0–6.1.21maven

org.springframework spring-webmvcRange6.1.0–6.1.21maven

org.springframework spring-webfluxRange6.2.0–6.2.18maven

org.springframework spring-webmvcRange6.2.0–6.2.18maven

org.springframework spring-webfluxRange7.0.0–7.0.7maven

org.springframework spring-webmvcRange7.0.0–7.0.7maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41844
spring	www.spring.io/security/cve-2026-41844
github	www.github.com/spring-projects/spring-framework/commit/3aaec987651cf82fd4ed7e0ed9b3deddcdf58853
github	www.github.com/spring-projects/spring-framework/commit/7add5243b9db13a9f8e765c8ab8545c8e8fe606b
github	www.github.com/spring-projects/spring-framework/releases/tag/v6.2.19
github	www.github.com/spring-projects/spring-framework/releases/tag/v7.0.8
github	www.github.com/advisories/GHSA-h3qp-gqrc-q736

30 Jul 2026 18:06Current

7.1High risk

Vulners AI Score7.1

CVSS 3.14.2 - 6.1

EPSS0.00145

SSVC

CWE-601