CVE-2026-41839

MediumCVSS 4.2/10Last modified Jul 23, 2026

Description

A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
Spring	Spring Framework	>= 7.0.0, < 7.0.7.1; >= 6.2.0, < 6.2.18.1; >= 6.1.0, < 6.1.28; >= 5.3.0, < 5.3.49

References

https://spring.io/security/cve-2026-41839Vendor Advisory

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-41849.8A vulnerability was detected in D-Link DIR-816 1.10CNB05. Affected by this vulnerability is an unknown functionality of the file /goform/for CVE-2026-418405.9Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring CVE-2026-418415.9Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Sp CVE-2026-418427.5Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: S CVE-2026-418435.9Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Fra CVE-2026-418446.1A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an at CVE-2026-418456.1Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially r CVE-2026-418466.1Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbi CVE-2026-418475.3Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.CVE-2026-418487.5Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to provide a pattern which is CVE-2026-418497.5An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by s CVE-2026-41856.3A vulnerability was found in GPAC up to 2.5-DEV-rev2167-gcc9d617c0-master. This vulnerability affects the function swf_def_bits_jpeg of the