CVE-2026-41841 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, apache-activemq-fips, apache-nifi-registry, kafbat-ui-fips, camunda, apache-activemq, kafbat-ui...

Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in spring-webmvc jar

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846 reported for spring-webmvc-6.2.12.jar and spring-webmvc-6.2.18.jar. Vulnerability Details CVEID:CVE-2026-41841 DESCRIPTION: Spring MVC and...

K000162181: Spring Framework vulnerability CVE-2026-41841

Security Advisory Description Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48. CVE-2026-41841 Impact Ther...

cn.deepbit:deepbit-sdk (8.3.7), cn.deepbit:deepbit-start-mvc (8.3.7) +170 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.3.23.release)

org.springframework:spring-webmvc MAVEN version 4.3.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.deepbit:deepbit-sdk 8.3.7 - cn.deepbit:deepbit-start-mvc 8.3.7 -...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +2344 more potentially affected by CVE-2026-41841 via org.springframework:spring-webflux (>=6.2.0, <=6.2.18)

org.springframework:spring-webflux MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-41841 Source advisory: GHSA-MQ64-J8F9-9GCJ...

com.51degrees:device-detection (>=4.4.1, <=4.4.2), com.51degrees:geo-location.web.examples.mvc (>=4.3.10, <=4.3.11) +132 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.3.30.release)

org.springframework:spring-webmvc MAVEN version 4.3.30.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.51degrees:device-detection =4.4.1, =4.3.10, =4.3.10, =4.3.14, =4.3.14, =4.3.14,...

com.3pillarglobal.labs:spring-integration-aws (2.0.0), com.auth0:spring-security-auth0 (0.2) +105 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (3.2.8.release)

org.springframework:spring-webmvc MAVEN version 3.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.3pillarglobal.labs:spring-integration-aws 2.0.0 - com.auth0:spring-security-auth0...

com.github.skeychen:dswork-config (>=9.0.1, <=9.1.1), com.github.skeychen:dswork-javaweb (>=9.0.1, <=9.1.1) +45 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.3.28.release)

org.springframework:spring-webmvc MAVEN version 4.3.28.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.skeychen:dswork-config =9.0.1, =9.0.1, =9.0.1, =2.2.0, =2.2.0, =2.2.0,...

org.springmodules:spring-modules-jakarta-commons (0.7), org.springmodules:spring-modules-osworkflow (0.7) potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (2.0.1)

org.springframework:spring-webmvc MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springmodules:spring-modules-jakarta-commons 0.7 -...

com.cedarsoft.commons:rmi (>=1.6.1, <=1.6.3), org.appfuse:appfuse-spring (2.0.1) +7 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (2.5)

org.springframework:spring-webmvc MAVEN version 2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.cedarsoft.commons:rmi =1.6.1, =2.0.3, =2.0.3, =2.0.4 -...

ch.ralscha:extdirectspring (1.7.3), cn.afterturn:easypoi-spring-boot-starter (>=0.1, <=0.1.1) +877 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.3.12.release)

org.springframework:spring-webmvc MAVEN version 4.3.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.ralscha:extdirectspring 1.7.3 - cn.afterturn:easypoi-spring-boot-starter =0.1,...

com.github.inspektr:inspektr-support-spring (1.0.0.ga), org.jasig.cas3.extensions:clearpass-impl (>=1.0.1.ga, <=1.0.5.ga) +25 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (3.0.1.release)

org.springframework:spring-webmvc MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.inspektr:inspektr-support-spring 1.0.0.ga -...

au.com.mountain-pass:hyperstate (>=4, <=9), ch.sbb.releasetrain:action (>=0.0.21, <=0.0.22) +493 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.2.6.release)

org.springframework:spring-webmvc MAVEN version 4.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - au.com.mountain-pass:hyperstate =4, =0.0.21, =0.0.21, =0.0.21, =0.0.21, =0.0.21,...

net.jawr.extensions:jawr-spring-extension (3.6), net.jawr.tools:jawr-ant (1.6) +11 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (2.0.8)

org.springframework:spring-webmvc MAVEN version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - net.jawr.extensions:jawr-spring-extension 3.6 - net.jawr.tools:jawr-ant 1.6 -...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +280 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.3.5.release)

org.springframework:spring-webmvc MAVEN version 4.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =0.0.25, =1.3.1, =0.0.25, =0.0.25,...

com.blitline:blitline-image-client-example (>=0.10.1, <=0.13.3), com.blitline:blitline-image-client-spring (>=0.10.1, <=0.13.3) +32 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.0.4.release)

org.springframework:spring-webmvc MAVEN version 4.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.blitline:blitline-image-client-example =0.10.1, =0.10.1, =v2.5.0-beta4, =2.4.0.rc...

com.54chen:paoding-rose (1.0), com.54chen:paoding-rose-portal (1.0) +14 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (2.5.6.sec02)

org.springframework:spring-webmvc MAVEN version 2.5.6.sec02 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.54chen:paoding-rose 1.0 - com.54chen:paoding-rose-portal 1.0 -...

cc.concurrent:config-server (0.1), ch.ralscha:extdirectspring (>=1.3.6, <=1.3.8) +186 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (3.2.4.release)

org.springframework:spring-webmvc MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cc.concurrent:config-server 0.1 - ch.ralscha:extdirectspring =1.3.6, =3.1.3, =3.1.3,...

africa.absa:inception-application (>=1.0.0, <=1.2.0), africa.absa:inception-test (>=1.0.0, <=1.2.0) +2958 more potentially affected by CVE-2026-41841 via org.springframework:spring-webflux (>=5.0.0.release, <=5.3.39)

org.springframework:spring-webflux MAVEN version =5.0.0.release, =1.0.0, =1.0.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =0.0.1, =v0.3.12, =v0.3.10, =v0.3.12, =2.1.2.release, =4.1.27, =4.1.7, =4.7.5 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 and more Sourc...

at.researchstudio.sat:won-node (>=0.4, <=0.6), at.researchstudio.sat:won-node-webapp (>=0.4, <=0.6) +716 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.3.18.release)

org.springframework:spring-webmvc MAVEN version 4.3.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.researchstudio.sat:won-node =0.4, =0.4, =0.4, =0.4, =3.5.19, =3.5.19, =1.5.14,...