ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +159 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.3.1.release)

org.springframework:spring-webmvc MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =1.1.4-release, =1.1.4-release,...

com.blitline:blitline-image-client-example (>=0.14.0, <=0.14.2), com.blitline:blitline-image-client-spring (>=0.14.0, <=0.14.2) +36 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.1.1.release)

org.springframework:spring-webmvc MAVEN version 4.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.blitline:blitline-image-client-example =0.14.0, =0.14.0, =1.3, =1.31, =1.2, =1.4,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +26 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.3.0.release)

org.springframework:spring-webmvc MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

cn.jairdavis:jair-common-utils (1.0.4), com.allenru:cross-origin (1.0.1) +43 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.0.2.release)

org.springframework:spring-webmvc MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.jairdavis:jair-common-utils 1.0.4 - com.allenru:cross-origin 1.0.1 -...

org.springframework.ws:spring-ws-core (1.0-m3) potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (2.0.2)

org.springframework:spring-webmvc MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springframework.ws:spring-ws-core 1.0-m3 Source cves: CVE-2026-41841 Source advisory:...

GHSA-MQ64-J8F9-9GCJ Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

ch.ralscha:extdirectspring (>=1.0.0, <=1.0.1), com.googlecode.rapid-framework:rapid-core (4.0) +44 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (3.0.3.release)

org.springframework:spring-webmvc MAVEN version 3.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.ralscha:extdirectspring =1.0.0, =0.9-milestone8.3, =0.9-milestone8.3, =5.4.0,...

GHSA-Q723-847Q-5G8G Spring Framework Predictable Session ID in WebSocket Module

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 throug...

Spring Framework Open Redirect in Spring MVC and WebFlux

A Spring MVC or Spring WebFlux application which configures a mapping for "/" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix. Affected versions: Spring Framework 7.0.0 through...

GHSA-83F7-V6PX-PP3H Spring Framework Denial of Service via Multipart Requests in WebFlux

Spring WebFlux applications are vulnerable to Denial of Service DoS attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

Spring Framework Denial of Service via Multipart Requests in WebFlux

Spring WebFlux applications are vulnerable to Denial of Service DoS attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

com.consol.citrus:citrus-websocket (>=2.5, <=2.6), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=0.0.4, <=0.0.5) +11 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.2.3.release)

org.springframework:spring-websocket MAVEN version 4.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.consol.citrus:citrus-websocket =2.5, =0.0.4, =0.0.4, =0.1.3, =0.1.5, =6.2.1...

com.github.mjeanroy:springmvc-mustache (>=0.6.0, <=1.0.0), com.github.mjeanroy:springmvc-mustache-handlebars (>=0.10.0, <=1.0.0) +28 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (4.3.27.release)

org.springframework:spring-webmvc MAVEN version 4.3.27.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.mjeanroy:springmvc-mustache =0.6.0, =0.10.0, =0.10.0, =0.10.0, =3.1.6,...

ch.sbb.releasetrain:jsfbootadapter (0.0.25), ch.sbb.releasetrain:webui (0.0.25) +343 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (4.2.7.release)

org.springframework:spring-webmvc MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.sbb.releasetrain:jsfbootadapter 0.0.25 - ch.sbb.releasetrain:webui 0.0.25 -...

ch.sbb.releasetrain:jsfbootadapter (0.0.25), ch.sbb.releasetrain:webui (0.0.25) +343 more potentially affected by CVE-2026-41841 via org.springframework:spring-webmvc (4.2.7.release)

org.springframework:spring-webmvc MAVEN version 4.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ch.sbb.releasetrain:jsfbootadapter 0.0.25 - ch.sbb.releasetrain:webui 0.0.25 -...

br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21), br.com.archbase:archbase-app-framework (>=2.0.0, <=2.1.21) +147 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (>=2.5.0, <=2.5.2)

org.springframework.hateoas:spring-hateoas MAVEN version =2.5.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41006 Source advisory: OSV:GHSA-7FXC-486F-32Q9...

cn.bestwu.simpleframework:simpleframework-security (>=0.1.12, <=0.1.17), co.bittub.api:core (1.0.0) +84 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.24.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.24.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - cn.bestwu.simpleframework:simpleframework-security =0.1.12, =1.0.0...

com.jdroidframework:jdroid-java-webapp-core (0.10.0), com.jdroidtools:jdroid-java-webapp-core (1.0.0) +18 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (3.2.18.release)

org.springframework:spring-webmvc MAVEN version 3.2.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.jdroidframework:jdroid-java-webapp-core 0.10.0 -...

com.blitline:blitline-image-client-example (>=0.10.1, <=0.17.1), com.blitline:blitline-image-client-spring (>=0.10.1, <=0.17.1) +5 more potentially affected by CVE-2026-41006 via org.springframework.hateoas:spring-hateoas (0.9.0.release)

org.springframework.hateoas:spring-hateoas MAVEN version 0.9.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.hateoas:spring-hateoas and may be impacted: - com.blitline:blitline-image-client-example =0.10.1, =0.10.1,...

cn.afterturn:easypoi-spring-boot-starter (>=0.2, <=4.0.0), cn.afterturn:easypoi-web (>=3.0.1, <=4.0.0) +162 more potentially affected by CVE-2026-41843 via org.springframework:spring-webmvc (3.1.1.release)

org.springframework:spring-webmvc MAVEN version 3.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.afterturn:easypoi-spring-boot-starter =0.2, =3.0.1, =3.1.0, =3.1.0, =1.0.4,...