CVE-2026-47883: URL Redirection to Untrusted Site

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

PT-2026-82692

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Spring...

PT-2026-82401

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

PT-2026-82403

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Description The PartEventHttpMessageReader in Spring WebFlux fails to enforce the maxPartSize limit whe...

CVE-2026-41847

A flaw was found in Spring WebFlux applications. This vulnerability allows for a security bypass when using the Kotlin Router DSL. An attacker could exploit this to bypass security restrictions, potentially leading to unauthorized access. Mitigation This vulnerability only applies when using Kotl...

CVE-2026-41840

A flaw was found in Spring WebFlux applications. A remote attacker could exploit this vulnerability by sending specially crafted multipart requests, leading to a Denial of Service DoS condition. This could make the application unavailable to legitimate users. Mitigation No specific mitigation is...

CVE-2026-41847

CVE-2026-41847...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through unbounded session retention in the handleInitRequest path of WebFluxStreamableServerTransportProvider and WebMvcStreamableServerTransportProvider. An unauthenticated remote...

Incorrect Authorization

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

Cross-site Scripting (XSS)

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

Allocation of Resources Without Limits or Throttling

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

Information Exposure

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

Open Redirect

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

Security Bulletin:Vulnerability in Spring MVC and WebFlux affects IBM Netezza Appliance

Summary The Spring MVC and WebFlux package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-41843 Vulnerability Details CVEID:CVE-2026-41843 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving...

Security Bulletin:Vulnerability in Spring WebFlux affects IBM Netezza Appliance

Summary The Spring WebFlux package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-41840 Vulnerability Details CVEID:CVE-2026-41840 DESCRIPTION: Spring WebFlux applications are vulnerable to Denial of Service DoS attacks when processing multipart...

Linux Distros Unpatched Vulnerability : CVE-2026-18401

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000...

K000162180: Spring WebFlux vulnerability CVE-2026-41840

Security Advisory Description Spring WebFlux applications are vulnerable to Denial of Service DoS attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48. CVE-2026-41840 Impact There is n...

K000161864: Spring WebFlux vulnerability CVE-2026-41847

Security Advisory Description Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48. CVE-2026-41847 Impact There is no impact; F5 products are not affected by this vulnerability. Security...

Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...