# org.springframework:spring-webflux (Maven) vulnerabilities 20 known vulnerabilities (3 critical, 4 high, 11 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.0.10 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 7.0.10 (Oct 22, 2026), the latest release - Dependents: 72 - Releases: 201 since 5.0.0.RELEASE (Sep 28, 2017) - Registry: https://central.sonatype.com/artifact/org.springframework/spring-webflux - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-47892: 5.2.5.RELEASE to 6.2.19 (7.0.0-M1 is outside it); 7.0.0 to 7.0.8 (7.0.9 is outside it) - CVE-2026-47890: 6.2.0 to 6.2.19 (7.0.0-M1 is outside it); 7.0.0 to 7.0.8 (7.0.9 is outside it) - CVE-2026-41853: 5.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41847: 5.0.0.RELEASE to 5.3.39 (6.0.0 is outside it) - CVE-2026-41844: 5.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41843: 5.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41842: 5.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41841: 5.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41840: 5.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41839: 5.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-22745: 5.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.17 (6.2.18 is outside it); 7.0.0 to 7.0.6 (7.0.7 is outside it) - CVE-2026-22741: 5.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.17 (6.2.18 is outside it); 7.0.0 to 7.0.6 (7.0.7 is outside it) - CVE-2026-22740: 5.0.0.RELEASE to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.17 (6.2.18 is outside it); 7.0.0 to 7.0.6 (7.0.7 is outside it) - CVE-2026-22737: 5.3.0 to 6.2.16 (6.2.17 is outside it); 7.0.0-M1 to 7.0.5 (7.0.6 is outside it) - CVE-2026-22735: 5.3.0 to 6.2.16 (6.2.17 is outside it); 7.0.0-M1 to 7.0.5 (7.0.6 is outside it) - CVE-2024-38819: 5.0.0.RELEASE to 6.1.13 (6.1.14 is outside it) - CVE-2024-38816: 5.3.0 to 6.1.12 (6.1.13 is outside it) - CVE-2022-22965: 5.0.0.RELEASE to 5.2.19.RELEASE (5.2.20.RELEASE is outside it); 5.3.0 to 5.3.17 (5.3.18 is outside it) - CVE-2020-5397: 5.2.0.RELEASE to 5.2.2.RELEASE (5.2.3.RELEASE is outside it) - CVE-2020-5398: 5.0.0.RELEASE to 5.0.15.RELEASE (5.0.16.RELEASE is outside it); 5.1.0.RELEASE to 5.1.12.RELEASE (5.1.13.RELEASE is outside it); 5.2.0.RELEASE to 5.2.2.RELEASE (5.2.3.RELEASE is outside it) ## Advisories (20) ### [CVE-2026-47892](https://cve.now/CVE-2026-47892): Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints - Severity: Critical 9.8 - Published: Aug 27, 2026 - Affected: from 5.2.5.RELEASE, through 5.2.25.RELEASE; from 5.3.0, through 5.3.49; from 6.0.0, through 6.0.30; from 6.1.0, through 6.1.28; from 6.2.0, through 6.2.19; from 7.0.0, fixed in 7.0.9. - Fixed in 7.0.9 (released Aug 20, 2026, 7 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-47890](https://cve.now/CVE-2026-47890): Spring Framework Server Sent Event stream corruption while rendering fragments - Severity: Critical 9.8 - Published: Aug 27, 2026 - Affected: from 6.2.0, through 6.2.19; from 7.0.0, fixed in 7.0.9. - Fixed in 7.0.9 (released Aug 20, 2026, 7 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41853](https://cve.now/CVE-2026-41853): Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux - Severity: Medium 5.3 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41847](https://cve.now/CVE-2026-41847): Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL - Severity: Medium 4.8 - Published: Jun 9, 2026 - Affected: through 5.3.39. - Fixed in 6.0.0 (released Nov 16, 2022, 1301 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41844](https://cve.now/CVE-2026-41844): Spring Framework Open Redirect in Spring MVC and WebFlux - Severity: Medium 4.2 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41843](https://cve.now/CVE-2026-41843): Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux - Severity: Medium 5.9 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41842](https://cve.now/CVE-2026-41842): Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux - Severity: High 7.5 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41841](https://cve.now/CVE-2026-41841): Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux - Severity: Medium 5.9 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41840](https://cve.now/CVE-2026-41840): Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. - Severity: Medium 5.9 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41839](https://cve.now/CVE-2026-41839): Spring Framework Escalation via Session Fixation in WebFlux - Severity: Medium 4.2 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-22745](https://cve.now/CVE-2026-22745): CVE-2026-22745 : Denial of service in static resource handling on Windows platforms - Severity: Medium 5.3 - Published: Apr 29, 2026 - Affected: from 7.0.0, fixed in 7.0.7; from 6.2.0, fixed in 6.2.18; from 6.1.0, through 6.1.26; through 5.3.47. - Fixed in 6.2.18 (released Apr 17, 2026, 12 days before disclosure) and 7.0.7 (released Apr 17, 2026, 12 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-22741](https://cve.now/CVE-2026-22741): Static resource cache poisoning in Spring MVC and WebFlux - Severity: Low 3.1 - Published: Apr 29, 2026 - Affected: from 7.0.0, fixed in 7.0.7; from 6.2.0, fixed in 6.2.18; from 6.1.0, through 6.1.26; through 5.3.47. - Fixed in 6.2.18 (released Apr 17, 2026, 12 days before disclosure) and 7.0.7 (released Apr 17, 2026, 12 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-22740](https://cve.now/CVE-2026-22740): Spring Framework DoS with Multipart Temp Files in WebFlux - Severity: Medium 6.5 - Published: Apr 29, 2026 - Affected: from 7.0.0, fixed in 7.0.7; from 6.2.0, fixed in 6.2.18; from 6.1.0, through 6.1.26; through 5.3.47. - Fixed in 6.2.18 (released Apr 17, 2026, 12 days before disclosure) and 7.0.7 (released Apr 17, 2026, 12 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-22737](https://cve.now/CVE-2026-22737): Spring Framework Improper Path Limitation with Script View Templates - Severity: Medium 5.9 - Published: Mar 19, 2026 - Affected: from 7.0.0-M1, fixed in 7.0.6; from 6.2.0, fixed in 6.2.17; from 6.0.0, through 6.1.21; from 5.3.0, through 5.3.39. - Fixed in 6.2.17 (released Mar 13, 2026, 6 days before disclosure) and 7.0.6 (released Mar 13, 2026, 6 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-22735](https://cve.now/CVE-2026-22735): Server Sent Event stream corruption - Severity: Low 2.6 - Published: Mar 19, 2026 - Affected: from 7.0.0-M1, fixed in 7.0.6; from 6.2.0, fixed in 6.2.17; from 6.0.0, through 6.1.21; from 5.3.0, through 5.3.39. - Fixed in 6.2.17 (released Mar 13, 2026, 6 days before disclosure) and 7.0.6 (released Mar 13, 2026, 6 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2024-38819](https://cve.now/CVE-2024-38819): Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal… - Severity: High 7.5 - Published: Dec 19, 2024 - Affected: from 6.1.0, fixed in 6.1.14; through 5.3.40; from 6.0.0, through 6.0.24. - Fixed in 6.1.14 (released Oct 17, 2024, 63 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2024-38816](https://cve.now/CVE-2024-38816): CVE-2024-38816: Path traversal vulnerability in functional web frameworks - Severity: High 7.5 - Published: Sep 13, 2024 - Affected: from 6.1.0, fixed in 6.1.13; from 6.0.0, through 6.0.23; from 5.3.0, through 5.3.39. - Fixed in 6.1.13 (released Sep 12, 2024, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2022-22965](https://cve.now/CVE-2022-22965): A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. - Severity: Critical 9.8 · KEV - Published: Apr 1, 2022 - Affected: fixed in 5.2.20.RELEASE; from 5.3.0, fixed in 5.3.18. - Fixed in 5.2.20.RELEASE (released Mar 31, 2022, 1 day before disclosure) and 5.3.18 (released Mar 31, 2022, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2020-5397](https://cve.now/CVE-2020-5397): CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux - Severity: Medium 5.3 - Published: Jan 17, 2020 - Affected: from 5.2.0, fixed in 5.2.3. - Fixed in 5.2.3.RELEASE (released Jan 14, 2020, 3 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2020-5398](https://cve.now/CVE-2020-5398): RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application - Severity: High 8.0 - Published: Jan 16, 2020 - Affected: from 5.2.0.RELEASE, fixed in 5.2.3.RELEASE; from 5.1.0.RELEASE, fixed in 5.1.13.RELEASE; from 5.0.0.RELEASE, fixed in 5.0.16.RELEASE. - Fixed in 5.0.16.RELEASE (released Jan 14, 2020, 2 days before disclosure), 5.1.13.RELEASE (released Jan 14, 2020, 2 days before disclosure) and 5.2.3.RELEASE (released Jan 14, 2020, 2 days before disclosure). - The latest release, 7.0.10, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.springframework:spring-webflux Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.