Security Bulletin: Vulnerability in Spring Framework affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Spring Framework has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service (ReDoS) in Spring Framework [CVE-2026-41848]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service ReDoS in Spring Framework CVE-2026-41848. Spring Framework is used as part of our microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability...

Security Bulletin: IBM Sterling Control Center is affected by a vulnerability in spring-core jar (CVE-2026-41848)

Summary IBM Sterling Control Center is affected by a vulnerability CVE-2026-41848 reported for spring-core-6.2.12.jar, spring-core-6.2.18.jar . Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an...

ch.rasc:sse-eventbus (1.1.9), com.atlassian.oai:swagger-request-validator-examples (>=2.9.1, <=2.13.0) +430 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.3.26.release)

org.springframework:spring-core MAVEN version 4.3.26.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ch.rasc:sse-eventbus 1.1.9 - com.atlassian.oai:swagger-request-validator-examples =2.9.1...

be.personify.iam:personify-api (>=1.0.2.release, <=1.0.8.release), club.trandiscuss:api-doc-gen (0.1) +862 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.3.25.release)

org.springframework:spring-core MAVEN version 4.3.25.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - be.personify.iam:personify-api =1.0.2.release, =1.0.2, =1.5.0, =1.4.10, =3.0.0,...

ch.hsr.mas.oms-financialanalyzer:indicators (1.2.0), ch.hsr.mas.oms-financialanalyzer:oms-api (1.2.0) +521 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (3.1.1.release)

org.springframework:spring-core MAVEN version 3.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ch.hsr.mas.oms-financialanalyzer:indicators 1.2.0 -...

ch.sbb.releasetrain:action (0.0.25), ch.sbb.releasetrain:config (0.0.25) +675 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.2.7.release)

org.springframework:spring-core MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ch.sbb.releasetrain:action 0.0.25 - ch.sbb.releasetrain:config 0.0.25 -...

ch.ralscha:extdirectspring (1.2.3), ch.tatool:tatool-app (>=1.3, <=1.3.2) +437 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (3.1.3.release)

org.springframework:spring-core MAVEN version 3.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ch.ralscha:extdirectspring 1.2.3 - ch.tatool:tatool-app =1.3, =1.3, =1.3, =0.16.5, =0.16....

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +200 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (3.2.0.release)

org.springframework:spring-core MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =0.4.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1,...

br.com.caelum.vraptor:vraptor-test (2.0.0), cc.concurrent:config-server (0.1) +527 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (3.2.4.release)

org.springframework:spring-core MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - br.com.caelum.vraptor:vraptor-test 2.0.0 - cc.concurrent:config-server 0.1 -...

au.com.centrumsystems:build-pipeline-plugin (1.0), ch.ethz.origo:origo-issue-notifier (1.0) +1113 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.5)

org.springframework:spring-core MAVEN version 2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - au.com.centrumsystems:build-pipeline-plugin 1.0 - ch.ethz.origo:origo-issue-notifier 1.0 -...

org.acegisecurity:acegi-security (>=1.0.0-rc2, <=1.0.0), org.acegisecurity:acegi-security-adapters (1.0.0) +20 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.0-m2)

org.springframework:spring-core MAVEN version 2.0-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.acegisecurity:acegi-security =1.0.0-rc2, =1.0.0 - org.acegisecurity:acegi-security-adapters...

cn.bridgeli:master-slave-db-selector (>=0.0.1, <=0.0.2), com.avanza.astrix:astrix-spring (>=0.38.1, <=0.43.6) +254 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.1.1.release)

org.springframework:spring-core MAVEN version 4.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - cn.bridgeli:master-slave-db-selector =0.0.1, =0.38.1, =2.7.0, =0.14.0, =0.14.0, =1.0.1-1,...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +20386 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (>=6.2.0, <=6.2.18)

org.springframework:spring-core MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-41848 Source advisory: GHSA-659M-PX2C-25WJ...

com.github.skeychen:dswork-common-ssosdk (>=9.0.1, <=9.1.1), com.github.skeychen:dswork-config (>=9.0.1, <=9.1.1) +131 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.3.28.release)

org.springframework:spring-core MAVEN version 4.3.28.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.github.skeychen:dswork-common-ssosdk =9.0.1, =9.0.1, =9.0.1, =9.0.1, =9.0.1, =9.0.1,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +358 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.3.1.release)

org.springframework:spring-core MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release, =1.1.0-releas...

cc.akkaha:pea-dubbo_2.12 (>=0.6.0, <=0.7.0), cc.akkaha:pea_2.12 (>=0.6.0, <=0.7.0) +1263 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.3.16.release)

org.springframework:spring-core MAVEN version 4.3.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - cc.akkaha:pea-dubbo2.12 =0.6.0, =0.6.0, =v1.0.0, =0.0.8.oss, =0.0.1, =0.0.1, =0.0.1,...

at.molindo:molindo-notify (2.1.0), be.dnsbelgium:rdap-server (1.1.0) +707 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.1.7.release)

org.springframework:spring-core MAVEN version 4.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - at.molindo:molindo-notify 2.1.0 - be.dnsbelgium:rdap-server 1.1.0 -...

de.codecentric:jmeter-graph-maven-plugin (0.1.0), net.sourceforge.openutils:openutils-bshd5 (>=2.0.3, <=2.0.4) +62 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.5.3)

org.springframework:spring-core MAVEN version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - de.codecentric:jmeter-graph-maven-plugin 0.1.0 - net.sourceforge.openutils:openutils-bshd5 =2.0.3...

co.fingerprintsoft:notification-spring-boot-autoconfigure (1.0.10), co.fingerprintsoft:notification-spring-boot-starter (1.0.10) +371 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.2.8.release)

org.springframework:spring-core MAVEN version 4.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - co.fingerprintsoft:notification-spring-boot-autoconfigure 1.0.10 -...