CVE-2026-41846

🗓️ 17 Jul 2026 13:19:56Reported by redhat.comType

redhatcve🔗 access.redhat.com👁 14 Views

Spring MVC XSS via JSP form tag attributes cssClass cssErrorClass cssStyle enabling script injection.

Reporter	Title	Published	Views	Family All 63
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Information Disclosure, Denial of Service (Dos) attacks, and Path Traversal attacks	26 Jun 202618:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Controller	21 Jul 202603:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC [CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846]	27 Jul 202620:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in spring-webmvc jar	27 Jul 202607:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	30 Jun 202610:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	22 Jul 202607:55	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring MVC and WebFlux affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Spring MVC affects IBM Netezza Appliance	12 Aug 202608:48	–	ibm
Chainguard	CVE-2026-41846 vulnerabilities	31 Jul 202620:22	–	cgr
CNNVD	Spring Framework 跨站脚本漏洞	9 Jun 202600:00	–	cnnvd

Source	Link
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41846
spring	www.spring.io/security/cve-2026-41846
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

17 Jul 2026 13:19Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.9 - 6.8

EPSS0.00152

SSVC

spring mvc cross site scripting jsp forms form tag attributes css class css error class css style spring framework