CVE-2026-41839
Fixed in a distro release EPSS <1%CVSS 4.2
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Products: Spring Framework
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework:spring-webflux | 7.0.8 |
| Maven | org.springframework:spring-webflux | 6.2.19 |
| Maven | org.springframework:spring-webflux | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kafbat-ui | 1.5.0-r12 |
| Chainguard | kafbat-ui-fips | 1.5.0-r6 |
| Chainguard | kayenta-2025.2 | no fix |
| Chainguard | kayenta-fips-2025.2 | no fix |
| Debian:12 | libspring-java | no fix |
| Debian:13 | libspring-java | no fix |
| Debian:14 | libspring-java | no fix |
| Ubuntu:25.10 | libspring-java | no fix |
| Ubuntu:26.04:LTS | libspring-java | no fix |
| Ubuntu:26.10 | libspring-java | no fix |
| Ubuntu:Pro:14.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:16.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:18.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:20.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:22.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:24.04:LTS | libspring-java | no fix |