CLEANSTART-2026-TZ04160 Security fix for CVE-2026-41853 applied in: activemq 5.19.8-r3, apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3, rundeck 6.0.0-r0

CVE-2026-41853 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-41853 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, apache-activemq-fips, kafbat-ui, apache-activemq, apache-nifi-registry, kafbat-ui-fips, camunda...

co.paralleluniverse:comsat-spring-boot (0.3.0), co.paralleluniverse:comsat-spring-webmvc (0.3.0) +47 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.0.8.release)

org.springframework:spring-webmvc MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.3.0 - co.paralleluniverse:comsat-spring-webm...

be.personify.iam:personify-api (>=1.0.2.release, <=1.0.8.release), cn.com.365trade.oss:xxl-job-admin (>=2.2.1_zzlh, <=2.2.1.1_zzlh) +275 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.25.release)

org.springframework:spring-webmvc MAVEN version 4.3.25.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - be.personify.iam:personify-api =1.0.2.release, =2.2.1zzlh, =a.1.1.1, =a.1.1.1,...

org.apache.rya:rya.export.accumulo (>=4.0.0-incubating, <=4.0.1), org.apache.rya:rya.indexing.example (>=4.0.0-incubating, <=4.0.1) +30 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (3.2.15.release)

org.springframework:spring-webmvc MAVEN version 3.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.apache.rya:rya.export.accumulo =4.0.0-incubating, =4.0.0-incubating,...

ch.ralscha:extdirectspring (1.7.3), cn.afterturn:easypoi-spring-boot-starter (>=0.1, <=0.1.1) +877 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.12.release)

org.springframework:spring-webmvc MAVEN version 4.3.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.ralscha:extdirectspring 1.7.3 - cn.afterturn:easypoi-spring-boot-starter =0.1,...

br.com.anteros:anteros-jsondoc-springboot (1.0.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.5) +324 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.2.5.release)

org.springframework:spring-webmvc MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - br.com.anteros:anteros-jsondoc-springboot 1.0.0 -...

at.molindo.social:spring-social-config (1.1.4.release), at.molindo.social:spring-social-security (1.1.4.release) +178 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.1.8.release)

org.springframework:spring-webmvc MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.molindo.social:spring-social-config 1.1.4.release -...

ch.ralscha:extdirectspring (1.6.1), com.aggrepoint.framework:winlet (>=0.1.6, <=0.1.17) +72 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.2.2.release)

org.springframework:spring-webmvc MAVEN version 4.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.ralscha:extdirectspring 1.6.1 - com.aggrepoint.framework:winlet =0.1.6, =1.0.0-rc3...

au.com.mountain-pass:hyperstate (>=1, <=3), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.4) +277 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.2.4.release)

org.springframework:spring-webmvc MAVEN version 4.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - au.com.mountain-pass:hyperstate =1, =0.0.10, =11.0.0, =1.1.5-7, =0.1.0, =1.0.0.releas...

com.mysema.web:webmin (0.2.3), org.parancoe:parancoe (0.3.3) +11 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (2.0.7)

org.springframework:spring-webmvc MAVEN version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.mysema.web:webmin 0.2.3 - org.parancoe:parancoe 0.3.3 - org.parancoe:parancoe-core 0.3.3 ...

com.github.inspektr:inspektr-support-spring (1.0.0.ga), org.jasig.cas3.extensions:clearpass-impl (>=1.0.1.ga, <=1.0.5.ga) +25 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (3.0.1.release)

org.springframework:spring-webmvc MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.inspektr:inspektr-support-spring 1.0.0.ga -...

org.acegisecurity:acegi-security (>=1.0.0-rc2, <=1.0.0), org.acegisecurity:acegi-security-adapters (1.0.0) +9 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (2.0-m2)

org.springframework:spring-webmvc MAVEN version 2.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.acegisecurity:acegi-security =1.0.0-rc2, =1.0.0-rc2, =1.0.0 -...

ch.ralscha:extdirectspring (>=1.0.4, <=1.0.11), com.github.greengerong:green.monitor (>=1.0, <=1.4) +302 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (3.0.5.release)

org.springframework:spring-webmvc MAVEN version 3.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.ralscha:extdirectspring =1.0.4, =1.0, =1.0.1.ga, =1.0.0, =1.0, =2011.11.07.release...

com.brienwheeler.web.tags:tags-blwform (>=1.0-release, <=1.11), com.brienwheeler.web.tags:tags-blwjawr (>=1.0-release, <=1.11) +138 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (3.2.9.release)

org.springframework:spring-webmvc MAVEN version 3.2.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.brienwheeler.web.tags:tags-blwform =1.0-release, =1.0-release, =1.0-release,...

ch.ralscha:extdirectspring (>=1.0.12, <=1.0.13), com.github.enpassant:ickenham-spring-mvc_2.11 (>=1.0.0, <=1.5.0) +76 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (3.0.6.release)

org.springframework:spring-webmvc MAVEN version 3.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.ralscha:extdirectspring =1.0.12, =1.0.0, =1.0.0, =1.0.10, =0.1, =1.0,...

net.sourceforge.openutils:openutils-spring (0.2) potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (2.0-m5)

org.springframework:spring-webmvc MAVEN version 2.0-m5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - net.sourceforge.openutils:openutils-spring 0.2 Source cves: CVE-2026-41853 Source advisory:...

org.springframework.ws:spring-ws-core (1.0-m3) potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (2.0.2)

org.springframework:spring-webmvc MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework.ws:spring-ws-core 1.0-m3 Source cves: CVE-2026-41853 Source advisory:...

com.github.hqstevenson.splunk:splunk.jms.activemq (>=1.1.0, <=2.1.1), de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1) +18 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (3.2.16.release)

org.springframework:spring-webmvc MAVEN version 3.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.hqstevenson.splunk:splunk.jms.activemq =1.1.0, =6.2.0, =5.11.4, =5.11.4,...

cn.jairdavis:jair-common-utils (1.0.4), com.allenru:cross-origin (1.0.1) +43 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.0.2.release)

org.springframework:spring-webmvc MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.jairdavis:jair-common-utils 1.0.4 - com.allenru:cross-origin 1.0.1 -...