Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.springframework:spring-webmvc

27 known vulnerabilities (3 critical, 6 high, 11 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
7.0.10 (Oct 22, 2026): no advisory affects it
Newest unaffected release
7.0.10 (Oct 22, 2026), the latest release
Advisories
27 · 3 critical, 6 high, 11 medium, 2 low
Dependents
739
Releases
343 since 1.0 (Dec 23, 2005)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-47890
    Affects 6.2.0 to 6.2.19 (7.0.0-M1 is outside it); 7.0.0 to 7.0.8 (7.0.9 is outside it)
  • CVE-2026-47884
    Affects 1.0-rc1 to 6.2.19 (7.0.0-M1 is outside it); 7.0.0 to 7.0.8 (7.0.9 is outside it)
  • CVE-2026-41853
    Affects 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it)
  • CVE-2026-41846
    Affects 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it)
  • CVE-2026-41845
    Affects 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it)
  • CVE-2026-41844
    Affects 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it)
  • CVE-2026-41843
    Affects 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it)
  • CVE-2026-41842
    Affects 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it)
  • CVE-2026-41841
    Affects 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it)
  • CVE-2026-22745
    Affects 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.17 (6.2.18 is outside it); 7.0.0 to 7.0.6 (7.0.7 is outside it)
  • CVE-2026-22741
    Affects 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.17 (6.2.18 is outside it); 7.0.0 to 7.0.6 (7.0.7 is outside it)
  • CVE-2026-22737
    Affects 5.3.0 to 6.2.16 (6.2.17 is outside it); 7.0.0-M1 to 7.0.5 (7.0.6 is outside it)
Show all 27 advisoriesShow fewer advisories
  • CVE-2026-22735
    Affects 5.3.0 to 6.2.16 (6.2.17 is outside it); 7.0.0-M1 to 7.0.5 (7.0.6 is outside it)
  • CVE-2025-41242
    Affects 5.3.0 to 6.2.9 (6.2.10 is outside it)
  • CVE-2024-38819
    Affects 1.0-rc1 to 6.1.13 (6.1.14 is outside it)
  • CVE-2024-38828
    Affects 5.3.0 to 5.3.39 (6.0.0 is outside it)
  • CVE-2024-38816
    Affects 5.3.0 to 6.1.12 (6.1.13 is outside it)
  • CVE-2023-34053
    Affects 6.0.0 to 6.0.13 (6.0.14 is outside it)
  • CVE-2023-20860
    Affects 5.3.0 to 5.3.25 (5.3.26 is outside it); 6.0.0 to 6.0.6 (6.0.7 is outside it)
  • CVE-2022-22965
    Affects 1.0-rc1 to 5.2.19.RELEASE (5.2.20.RELEASE is outside it); 5.3.0 to 5.3.17 (5.3.18 is outside it)
  • CVE-2020-5397
    Affects 5.2.0.RELEASE to 5.2.2.RELEASE (5.2.3.RELEASE is outside it)
  • CVE-2020-5398
    Affects 5.0.0.RELEASE to 5.0.15.RELEASE (5.0.16.RELEASE is outside it); 5.1.0.RELEASE to 5.1.12.RELEASE (5.1.13.RELEASE is outside it); 5.2.0.RELEASE to 5.2.2.RELEASE (5.2.3.RELEASE is outside it)
  • CVE-2014-0225
    Affects 3.0.0.RELEASE to 3.2.7.RELEASE (3.2.8.RELEASE is outside it); 4.0.0.RELEASE to 4.0.4.RELEASE (4.0.5.RELEASE is outside it)
  • CVE-2016-9878
    Affects 1.0-rc1 to 3.2.17.RELEASE (3.2.18.RELEASE is outside it); 4.2.0.RELEASE to 4.2.8.RELEASE (4.2.9.RELEASE is outside it); 4.3.0.RELEASE to 4.3.4.RELEASE (4.3.5.RELEASE is outside it)
  • CVE-2014-3625
    Affects 3.0.4.RELEASE to 3.2.11.RELEASE (3.2.12.RELEASE is outside it); 4.0.0.RELEASE to 4.0.7.RELEASE (4.0.8.RELEASE is outside it); 4.1.0.RELEASE to 4.1.1.RELEASE (4.1.2.RELEASE is outside it)
  • CVE-2014-0054
    Affects 1.0-rc1 to 3.2.7.RELEASE (3.2.8.RELEASE is outside it); 4.0.0.RELEASE to 4.0.1.RELEASE (4.0.2.RELEASE is outside it)
  • CVE-2014-1904
    Affects 3.0.0.RELEASE to 3.2.7.RELEASE (3.2.8.RELEASE is outside it); 4.0.0.RELEASE to 4.0.1.RELEASE (4.0.2.RELEASE is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 27

  • CVE-2026-47890Critical 9.8

    Spring Framework Server Sent Event stream corruption while rendering fragments

    Affected: from 6.2.0, through 6.2.19; from 7.0.0, fixed in 7.0.9.

    Fixed in 7.0.9 (released Aug 20, 2026, 7 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2026-47884Critical 9.8

    Spring Framework Improper Path Limitation in XsltView

    Affected: through 5.2.25.RELEASE; from 5.3.0, through 5.3.49; from 6.0.0, through 6.0.30; from 6.1.0, through 6.1.28; from 6.2.0, through 6.2.19; from 7.0.0, fixed in 7.0.9.

    Fixed in 7.0.9 (released Aug 20, 2026, 7 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2026-41853Medium 5.3

    Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux

    Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39.

    Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2026-41846Medium 5.9

    Spring Framework Cross-site Scripting via JSP Form Tags

    Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39.

    Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure).

    The latest release, 7.0.10, is not affected.

  • Spring Framework Cross-site Scripting via JavaScriptUtils

    Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39.

    Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2026-41844Medium 4.2

    Spring Framework Open Redirect in Spring MVC and WebFlux

    Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39.

    Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2026-41843Medium 5.9

    Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux

    Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39.

    Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure).

    The latest release, 7.0.10, is not affected.

  • Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

    Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39.

    Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2026-41841Medium 5.9

    Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

    Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39.

    Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2026-22745Medium 5.3

    CVE-2026-22745 : Denial of service in static resource handling on Windows platforms

    Affected: from 7.0.0, fixed in 7.0.7; from 6.2.0, fixed in 6.2.18; from 6.1.0, through 6.1.26; through 5.3.47.

    Fixed in 6.2.18 (released Apr 17, 2026, 12 days before disclosure) and 7.0.7 (released Apr 17, 2026, 12 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • Static resource cache poisoning in Spring MVC and WebFlux

    Affected: from 7.0.0, fixed in 7.0.7; from 6.2.0, fixed in 6.2.18; from 6.1.0, through 6.1.26; through 5.3.47.

    Fixed in 6.2.18 (released Apr 17, 2026, 12 days before disclosure) and 7.0.7 (released Apr 17, 2026, 12 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2026-22737Medium 5.9

    Spring Framework Improper Path Limitation with Script View Templates

    Affected: from 7.0.0-M1, fixed in 7.0.6; from 6.2.0, fixed in 6.2.17; from 6.0.0, through 6.1.21; from 5.3.0, through 5.3.39.

    Fixed in 6.2.17 (released Mar 13, 2026, 6 days before disclosure) and 7.0.6 (released Mar 13, 2026, 6 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • Server Sent Event stream corruption

    Affected: from 7.0.0-M1, fixed in 7.0.6; from 6.2.0, fixed in 6.2.17; from 6.0.0, through 6.1.21; from 5.3.0, through 5.3.39.

    Fixed in 6.2.17 (released Mar 13, 2026, 6 days before disclosure) and 7.0.6 (released Mar 13, 2026, 6 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2025-41242Medium 5.9

    CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

    Affected: from 6.2.0, fixed in 6.2.10; from 6.1.0, through 6.1.21; from 6.0.0, through 6.0.29; from 5.3.0, through 5.3.43.

    Fixed in 6.2.10 (released Aug 14, 2025, 4 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal…

    Affected: from 6.1.0, fixed in 6.1.14; through 5.3.40; from 6.0.0, through 6.0.24.

    Fixed in 6.1.14 (released Oct 17, 2024, 63 days before disclosure).

    The latest release, 7.0.10, is not affected.

Show all 27 advisoriesShow fewer advisories
  • CVE-2024-38828Medium 5.3

    CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter

    Affected: from 5.3.0, fixed in 5.3.42.

    Fixed in 6.0.0 (released Nov 16, 2022, 733 days before disclosure, the advisory names 5.3.42, which was never published).

    The latest release, 7.0.10, is not affected.

  • CVE-2024-38816: Path traversal vulnerability in functional web frameworks

    Affected: from 6.1.0, fixed in 6.1.13; from 6.0.0, through 6.0.23; from 5.3.0, through 5.3.39.

    Fixed in 6.1.13 (released Sep 12, 2024, 1 day before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2023-34053Medium 5.3

    Spring Framework server Web Observations DoS Vulnerability

    Affected: from 6.0.0, fixed in 6.0.14.

    Fixed in 6.0.14 (released Nov 16, 2023, 12 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the…

    Affected: from 6.0.0, fixed in 6.0.7; from 5.3.0, fixed in 5.3.26.

    Fixed in 5.3.26 (released Mar 20, 2023, 7 days before disclosure) and 6.0.7 (released Mar 20, 2023, 7 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2022-22965Critical 9.8 · KEV

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

    Affected: fixed in 5.2.20.RELEASE; from 5.3.0, fixed in 5.3.18.

    Fixed in 5.2.20.RELEASE (released Mar 31, 2022, 1 day before disclosure) and 5.3.18 (released Mar 31, 2022, 1 day before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2020-5397Medium 5.3

    CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux

    Affected: from 5.2.0, fixed in 5.2.3.

    Fixed in 5.2.3.RELEASE (released Jan 14, 2020, 3 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

    Affected: from 5.2.0.RELEASE, fixed in 5.2.3.RELEASE; from 5.1.0.RELEASE, fixed in 5.1.13.RELEASE; from 5.0.0.RELEASE, fixed in 5.0.16.RELEASE.

    Fixed in 5.0.16.RELEASE (released Jan 14, 2020, 2 days before disclosure), 5.1.13.RELEASE (released Jan 14, 2020, 2 days before disclosure) and 5.2.3.RELEASE (released Jan 14, 2020, 2 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported…

    Affected: from 4.0.0, fixed in 4.0.5; from 3.0.0, fixed in 3.2.8.

    Fixed in 3.2.8.RELEASE (released Feb 19, 2014, 1191 days before disclosure) and 4.0.5.RELEASE (released May 20, 2014, 1101 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5.

    Affected: fixed in 3.2.18; from 4.2.0, fixed in 4.2.9; from 4.3.0, fixed in 4.3.5.

    Fixed in 3.2.18.RELEASE (released Dec 21, 2016, 8 days before disclosure), 4.2.9.RELEASE (released Dec 21, 2016, 8 days before disclosure) and 4.3.5.RELEASE (released Dec 21, 2016, 8 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before…

    Affected: from 3.0.4, fixed in 3.2.12; from 4.0.0, fixed in 4.0.8; from 4.1.0, fixed in 4.1.2.

    Fixed in 3.2.12.RELEASE (released Nov 11, 2014, 9 days before disclosure), 4.0.8.RELEASE (released Nov 11, 2014, 9 days before disclosure) and 4.1.2.RELEASE (released Nov 11, 2014, 9 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external…

    Affected: fixed in 3.2.8; from 4.0.0, fixed in 4.0.2.

    Fixed in 3.2.8.RELEASE (released Feb 19, 2014, 57 days before disclosure) and 4.0.2.RELEASE (released Feb 19, 2014, 57 days before disclosure).

    The latest release, 7.0.10, is not affected.

  • Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and…

    Affected: from 3.0.0, fixed in 3.2.8.RELEASE; from 4.0.0, fixed in 4.0.2.RELEASE.

    Fixed in 3.2.8.RELEASE (released Feb 19, 2014, 29 days before disclosure) and 4.0.2.RELEASE (released Feb 19, 2014, 29 days before disclosure).

    The latest release, 7.0.10, is not affected.