GHSA-H3QP-GQRC-Q736 Spring Framework Open Redirect in Spring MVC and WebFlux

🗓️ 09 Jun 2026 06:31:57Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Spring Framework open redirect in MVC/WebFlux via redirect: when mapping all paths without a view name to external host.

Reporter	Title	Published	Views	Family All 42
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Information Disclosure, Denial of Service (Dos) attacks, and Path Traversal attacks	26 Jun 202618:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Controller	21 Jul 202603:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC [CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846]	27 Jul 202620:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in spring-webmvc jar	27 Jul 202607:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	30 Jun 202610:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	22 Jul 202607:55	–	ibm
Chainguard	CVE-2026-41844 vulnerabilities	31 Jul 202620:22	–	cgr
CNNVD	VMware Spring Framework 输入验证错误漏洞	9 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41844	9 Jun 202603:50	–	cve
Cvelist	CVE-2026-41844 Spring Framework Open Redirect in Spring MVC and WebFlux	9 Jun 202603:50	–	cvelist

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41844
github	www.github.com/spring-projects/spring-framework/commit/3aaec987651cf82fd4ed7e0ed9b3deddcdf58853
github	www.github.com/spring-projects/spring-framework/commit/7add5243b9db13a9f8e765c8ab8545c8e8fe606b
github	www.github.com/spring-projects/spring-framework
github	www.github.com/spring-projects/spring-framework/releases/tag/v6.2.19
github	www.github.com/spring-projects/spring-framework/releases/tag/v7.0.8
spring	www.spring.io/security/cve-2026-41844

31 Jul 2026 21:29Current

7.1High risk

Vulners AI Score7.1

CVSS 3.14.2

EPSS0.00134