PT-2026-47658

Name of the Vulnerable Software and Affected Versions Spring Framework versions 5.3.0 through 5.3.48 Description Spring WebFlux applications may be subject to a security bypass when utilizing the Kotlin Router DSL. Recommendations At the moment, there is no information about a newer version that...

CVE-2026-41847

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48...

PT-2026-47653

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.7 Spring Framework versions 6.2.0 through 6.2.18 Spring Framework versions 6.1.0 through 6.1.27 Spring Framework versions 5.3.0 through 5.3.48 Description Spring MVC and WebFlux applications are...

PT-2026-47652

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.7 Spring Framework versions 6.2.0 through 6.2.18 Spring Framework versions 6.1.0 through 6.1.27 Spring Framework versions 5.3.0 through 5.3.48 Description Spring MVC and WebFlux applications are...

Spring Framework 授权问题漏洞

The Spring Framework is an application development framework developed by Spring in open source. Versions 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, and 5.3.0 to 5.3.48 of the Spring Framework contain authorization vulnerabilities. These vulnerabilities stem from the WebFlux application,...

Spring Framework 环境问题漏洞

The Spring Framework is an application development framework developed by Spring in open source. Versions of the Spring Framework such as 7.0.0 and earlier, 6.2.0 and earlier, 6.1.0 and earlier, and 5.3.0 and earlier have environmental vulnerabilities. These vulnerabilities stem from the fact tha...

ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +743 more potentially affected by CVE-2026-41842 via org.springframework:spring-webflux (>=7.0.0-M7 <=7.0.7)

org.springframework:spring-webflux MAVEN version =7.0.0-M7, =0.1.0, =0.1.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =0.0.1-alfa, =0.0.1-demo, =2.0.8, =3.0.1 and more Source cves: CVE-2026-41842 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254543...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0 <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0 <=0.2.0) +2678 more potentially affected by CVE-2026-41841 via org.springframework:spring-webflux (>=6.1.0 <=6.2.18)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.6 and more Source cves: CVE-2026-41841 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254528...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0 <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0 <=0.2.0) +2678 more potentially affected by CVE-2026-41844 via org.springframework:spring-webflux (>=6.1.0 <=6.2.18)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.6 and more Source cves: CVE-2026-41844 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254122...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0 <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0 <=0.2.0) +2678 more potentially affected by CVE-2026-41842 via org.springframework:spring-webflux (>=6.1.0 <=6.2.18)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =1.0.0, =1.0.0, =1.2.4, =1.2.4, =1.2.4, =1.2.6 and more Source cves: CVE-2026-41842 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254543...

africa.absa:inception-application (>=1.0.0 <=1.2.0), africa.absa:inception-test (>=1.0.0 <=1.2.0) +2168 more potentially affected by CVE-2026-41844 via org.springframework:spring-webflux (>=5.3.0 <=5.3.9)

org.springframework:spring-webflux MAVEN version =5.3.0, =1.0.0, =1.0.0, =j8.2.4.0, =v0.3.12, =v0.3.10, =v0.3.12, =4.1.27, =4.1.36, =1.3, =1.0, =1.0.4.R, =1.0.0, =1.0.3 and more Source cves: CVE-2026-41844 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254122...

africa.absa:inception-application (>=1.0.0 <=1.2.0), africa.absa:inception-test (>=1.0.0 <=1.2.0) +2168 more potentially affected by CVE-2026-41842 via org.springframework:spring-webflux (>=5.3.0 <=5.3.9)

org.springframework:spring-webflux MAVEN version =5.3.0, =1.0.0, =1.0.0, =j8.2.4.0, =v0.3.12, =v0.3.10, =v0.3.12, =4.1.27, =4.1.36, =1.3, =1.0, =1.0.4.R, =1.0.0, =1.0.3 and more Source cves: CVE-2026-41842 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254543...

CVE-2026-41840: Spring Framework Denial of Service via Multipart Requests in WebFlux

Spring WebFlux applications are vulnerable to Denial of Service DoS attacks when processing multipart requests. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, an attacker can send malicious multipart requests that can leak...

africa.absa:inception-application (>=1.0.0 <=1.2.0), africa.absa:inception-test (>=1.0.0 <=1.2.0) +2168 more potentially affected by CVE-2026-41843 via org.springframework:spring-webflux (>=5.3.0 <=5.3.9)

org.springframework:spring-webflux MAVEN version =5.3.0, =1.0.0, =1.0.0, =j8.2.4.0, =v0.3.12, =v0.3.10, =v0.3.12, =4.1.27, =4.1.36, =1.3, =1.0, =1.0.4.R, =1.0.0, =1.0.3 and more Source cves: CVE-2026-41843 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254115...

CVE-2026-41842: Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, an attacker can send malicious requests that are slow to...

ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +743 more potentially affected by CVE-2026-41843 via org.springframework:spring-webflux (>=7.0.0-M7 <=7.0.7)

org.springframework:spring-webflux MAVEN version =7.0.0-M7, =0.1.0, =0.1.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =0.0.1-alfa, =0.0.1-demo, =2.0.8, =3.0.1 and more Source cves: CVE-2026-41843 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-17254115...

Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, any security-related modifications applied to the ServerRequest by the filt...

Incorrect Authorization

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

Direct Request ('Forced Browsing')

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

Open Redirect

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...