ROOT-APP-MAVEN-CVE-2026-40986 CVE-2026-40986 in io.root.org.springframework.webflow:spring-js-resources - Patched by Root

Root has patched CVE-2026-40986 in the io.root.org.springframework.webflow:spring-js-resources package for Root:Maven. Multiple fixed versions available...

org.apereo.cas:cas-server-core (>=8.0.0-rc1, <=8.0.0-rc5), org.apereo.cas:cas-server-core-api (>=8.0.0-rc1, <=8.0.0-rc5) +342 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (4.0.0)

org.springframework.webflow:spring-webflow MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.webflow:spring-webflow and may be impacted: - org.apereo.cas:cas-server-core =8.0.0-rc1, =8.0.0-rc1, =8.0.0-rc1,...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.webapp.modules:cloud-altemistafwk-webapp-jsf-conf (>=3.0.0.release, <=3.1.0.release) +733 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (>=2.0.6.release, <=2.5.1.release)

org.springframework.webflow:spring-webflow MAVEN version =2.0.6.release, =3.0.0.release, =3.0.0.release, =2.0.0, =2.3.0, =2.1.0, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =0.0.1, =5.1.3, =5.3.4 and more Source cves: CVE-2026-40986 Source advisory: OSV:GHSA-HW5C...

org.apereo.cas:cas-server-core (>=8.0.0-rc1, <=8.0.0-rc5), org.apereo.cas:cas-server-core-api (>=8.0.0-rc1, <=8.0.0-rc5) +342 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (4.0.0)

org.springframework.webflow:spring-webflow MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.webflow:spring-webflow and may be impacted: - org.apereo.cas:cas-server-core =8.0.0-rc1, =8.0.0-rc1, =8.0.0-rc1,...

CVE-2026-40986

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker...

org.apereo.cas:cas-server-core (>=8.0.0-rc1, <=8.0.0-rc5), org.apereo.cas:cas-server-core-api (>=8.0.0-rc1, <=8.0.0-rc5) +342 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (4.0.0)

org.springframework.webflow:spring-webflow MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.webflow:spring-webflow and may be impacted: - org.apereo.cas:cas-server-core =8.0.0-rc1, =8.0.0-rc1, =8.0.0-rc1,...