CLEANSTART-2026-TZ04160 Security fix for CVE-2026-41853 applied in: activemq 5.19.8-r3, apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3, rundeck 6.0.0-r0

CVE-2026-41853 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-41853 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, apache-activemq, camunda, camunda-zeebe, kafbat-ui, apache-activemq-fips, kafbat-ui-fips...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.1.1, <=0.112.0) +1743 more potentially affected by CVE-2026-41853 via org.springframework:spring-webflux (>=6.1.0, <=6.1.21)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =0.5.0, =1.2.0, =1.1.0, =1.3.0 and more Source cves: CVE-2026-41853 Source advisory: GHSA-CJPG-RGQ5-FR37...

at.researchstudio.sat:won-node (>=0.4, <=0.6), at.researchstudio.sat:won-node-webapp (>=0.4, <=0.6) +716 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.18.release)

org.springframework:spring-webmvc MAVEN version 4.3.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.researchstudio.sat:won-node =0.4, =0.4, =0.4, =0.4, =3.5.19, =3.5.19, =1.5.14,...

ch.ralscha:extdirectspring (1.4.0), ch.rasc:wampspring (1.0.0) +62 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.0.0.release)

org.springframework:spring-webmvc MAVEN version 4.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.ralscha:extdirectspring 1.4.0 - ch.rasc:wampspring 1.0.0 - com.daikit:daikit4gxt 0...

co.paralleluniverse:comsat-spring-boot (0.3.0), co.paralleluniverse:comsat-spring-webmvc (0.3.0) +47 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.0.8.release)

org.springframework:spring-webmvc MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.3.0 - co.paralleluniverse:comsat-spring-webm...

biz.jovido:jovido-webseed (>=0.0.1, <=0.0.1-fenicesfa), biz.jovido:jovido-webseed-fenicesfa (0.0.1) +724 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.9.release)

org.springframework:spring-webmvc MAVEN version 4.3.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - biz.jovido:jovido-webseed =0.0.1, =1.1, =1.7, =1.1.1, =1.0, =1.0.1, =1.1.12, =1.1.12,...

com.consol.citrus:citrus-http (2.2), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +78 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.0.7.release)

org.springframework:spring-webmvc MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.consol.citrus:citrus-http 2.2 - de.codecentric:jbehave-admin-server =0.0.1, =1.0....

com.github.hqstevenson.splunk:splunk.jms.activemq (>=1.1.0, <=2.1.1), de.the-library-code.dspace:addon-duplication-detection-service-jspui (>=6.2.0, <=6.3.1) +18 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (3.2.16.release)

org.springframework:spring-webmvc MAVEN version 3.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.hqstevenson.splunk:splunk.jms.activemq =1.1.0, =6.2.0, =5.11.4, =5.11.4,...

ch.ralscha:extdirectspring (1.7.4), ch.rasc:sse-eventbus (>=1.1.4, <=1.1.5) +958 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.13.release)

org.springframework:spring-webmvc MAVEN version 4.3.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.ralscha:extdirectspring 1.7.4 - ch.rasc:sse-eventbus =1.1.4, =1.0-release, =0.0.1...

be.personify.iam:personify-api (>=1.0.2.release, <=1.0.8.release), cn.com.365trade.oss:xxl-job-admin (>=2.2.1_zzlh, <=2.2.1.1_zzlh) +275 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.25.release)

org.springframework:spring-webmvc MAVEN version 4.3.25.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - be.personify.iam:personify-api =1.0.2.release, =2.2.1zzlh, =a.1.1.1, =a.1.1.1,...

org.springframework.ws:spring-ws-core (1.0-m3) potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (2.0.2)

org.springframework:spring-webmvc MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework.ws:spring-ws-core 1.0-m3 Source cves: CVE-2026-41853 Source advisory:...

org.apache.rya:rya.export.accumulo (>=4.0.0-incubating, <=4.0.1), org.apache.rya:rya.indexing.example (>=4.0.0-incubating, <=4.0.1) +30 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (3.2.15.release)

org.springframework:spring-webmvc MAVEN version 3.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.apache.rya:rya.export.accumulo =4.0.0-incubating, =4.0.0-incubating,...

at.molindo.social:spring-social-config (1.1.4.release), at.molindo.social:spring-social-security (1.1.4.release) +178 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.1.8.release)

org.springframework:spring-webmvc MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.molindo.social:spring-social-config 1.1.4.release -...

com.alibaba.citrus:citrus-test-all (>=3.1.6, <=3.2.4), com.alibaba.citrus:citrus-webx-all (>=3.1.6, <=3.2.4) +34 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (3.2.7.release)

org.springframework:spring-webmvc MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.alibaba.citrus:citrus-test-all =3.1.6, =3.1.6, =0.10.0, =1.0.1, =0.8.3, =1.0,...

cn.bestwu:fastjson (>=1.1-unwrap, <=1.2-unwrap), co.paralleluniverse:comsat-spring-boot (0.6.0) +300 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.2.3.release)

org.springframework:spring-webmvc MAVEN version 4.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.bestwu:fastjson =1.1-unwrap, =3.5, =1.2.6, =3.0.0-0, =2.5, =2.5, =2.5, =2.6 -...

cn.jairdavis:jair-common-utils (1.0.4), com.allenru:cross-origin (1.0.1) +43 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.0.2.release)

org.springframework:spring-webmvc MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.jairdavis:jair-common-utils 1.0.4 - com.allenru:cross-origin 1.0.1 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +159 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.1.release)

org.springframework:spring-webmvc MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =1.1.4-release, =1.1.4-release,...

at.researchstudio.sat:won-facets (>=0.2, <=0.3), at.researchstudio.sat:won-facets-tx (>=0.2, <=0.3) +664 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.8.release)

org.springframework:spring-webmvc MAVEN version 4.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.researchstudio.sat:won-facets =0.2, =0.2, =0.2.7, =0.0.1-release, =0.0.3, =0.0.1,...

ch.ralscha:extdirectspring (1.6.1), com.aggrepoint.framework:winlet (>=0.1.6, <=0.1.17) +72 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.2.2.release)

org.springframework:spring-webmvc MAVEN version 4.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.ralscha:extdirectspring 1.6.1 - com.aggrepoint.framework:winlet =0.1.6, =1.0.0-rc3...