# org.springframework:spring-webmvc (Maven) vulnerabilities 27 known vulnerabilities (3 critical, 6 high, 11 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.0.10 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 7.0.10 (Oct 22, 2026), the latest release - Dependents: 739 - Releases: 343 since 1.0 (Dec 23, 2005) - Registry: https://central.sonatype.com/artifact/org.springframework/spring-webmvc - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-47890: 6.2.0 to 6.2.19 (7.0.0-M1 is outside it); 7.0.0 to 7.0.8 (7.0.9 is outside it) - CVE-2026-47884: 1.0-rc1 to 6.2.19 (7.0.0-M1 is outside it); 7.0.0 to 7.0.8 (7.0.9 is outside it) - CVE-2026-41853: 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41846: 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41845: 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41844: 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41843: 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41842: 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-41841: 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.18 (6.2.19 is outside it); 7.0.0 to 7.0.7 (7.0.8 is outside it) - CVE-2026-22745: 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.17 (6.2.18 is outside it); 7.0.0 to 7.0.6 (7.0.7 is outside it) - CVE-2026-22741: 1.0-rc1 to 5.3.39 (6.0.0 is outside it); 6.1.0 to 6.2.17 (6.2.18 is outside it); 7.0.0 to 7.0.6 (7.0.7 is outside it) - CVE-2026-22737: 5.3.0 to 6.2.16 (6.2.17 is outside it); 7.0.0-M1 to 7.0.5 (7.0.6 is outside it) - CVE-2026-22735: 5.3.0 to 6.2.16 (6.2.17 is outside it); 7.0.0-M1 to 7.0.5 (7.0.6 is outside it) - CVE-2025-41242: 5.3.0 to 6.2.9 (6.2.10 is outside it) - CVE-2024-38819: 1.0-rc1 to 6.1.13 (6.1.14 is outside it) - CVE-2024-38828: 5.3.0 to 5.3.39 (6.0.0 is outside it) - CVE-2024-38816: 5.3.0 to 6.1.12 (6.1.13 is outside it) - CVE-2023-34053: 6.0.0 to 6.0.13 (6.0.14 is outside it) - CVE-2023-20860: 5.3.0 to 5.3.25 (5.3.26 is outside it); 6.0.0 to 6.0.6 (6.0.7 is outside it) - CVE-2022-22965: 1.0-rc1 to 5.2.19.RELEASE (5.2.20.RELEASE is outside it); 5.3.0 to 5.3.17 (5.3.18 is outside it) - CVE-2020-5397: 5.2.0.RELEASE to 5.2.2.RELEASE (5.2.3.RELEASE is outside it) - CVE-2020-5398: 5.0.0.RELEASE to 5.0.15.RELEASE (5.0.16.RELEASE is outside it); 5.1.0.RELEASE to 5.1.12.RELEASE (5.1.13.RELEASE is outside it); 5.2.0.RELEASE to 5.2.2.RELEASE (5.2.3.RELEASE is outside it) - CVE-2014-0225: 3.0.0.RELEASE to 3.2.7.RELEASE (3.2.8.RELEASE is outside it); 4.0.0.RELEASE to 4.0.4.RELEASE (4.0.5.RELEASE is outside it) - CVE-2016-9878: 1.0-rc1 to 3.2.17.RELEASE (3.2.18.RELEASE is outside it); 4.2.0.RELEASE to 4.2.8.RELEASE (4.2.9.RELEASE is outside it); 4.3.0.RELEASE to 4.3.4.RELEASE (4.3.5.RELEASE is outside it) - CVE-2014-3625: 3.0.4.RELEASE to 3.2.11.RELEASE (3.2.12.RELEASE is outside it); 4.0.0.RELEASE to 4.0.7.RELEASE (4.0.8.RELEASE is outside it); 4.1.0.RELEASE to 4.1.1.RELEASE (4.1.2.RELEASE is outside it) - CVE-2014-0054: 1.0-rc1 to 3.2.7.RELEASE (3.2.8.RELEASE is outside it); 4.0.0.RELEASE to 4.0.1.RELEASE (4.0.2.RELEASE is outside it) - CVE-2014-1904: 3.0.0.RELEASE to 3.2.7.RELEASE (3.2.8.RELEASE is outside it); 4.0.0.RELEASE to 4.0.1.RELEASE (4.0.2.RELEASE is outside it) ## Advisories (27) ### [CVE-2026-47890](https://cve.now/CVE-2026-47890): Spring Framework Server Sent Event stream corruption while rendering fragments - Severity: Critical 9.8 - Published: Aug 27, 2026 - Affected: from 6.2.0, through 6.2.19; from 7.0.0, fixed in 7.0.9. - Fixed in 7.0.9 (released Aug 20, 2026, 7 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-47884](https://cve.now/CVE-2026-47884): Spring Framework Improper Path Limitation in XsltView - Severity: Critical 9.8 - Published: Aug 27, 2026 - Affected: through 5.2.25.RELEASE; from 5.3.0, through 5.3.49; from 6.0.0, through 6.0.30; from 6.1.0, through 6.1.28; from 6.2.0, through 6.2.19; from 7.0.0, fixed in 7.0.9. - Fixed in 7.0.9 (released Aug 20, 2026, 7 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41853](https://cve.now/CVE-2026-41853): Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux - Severity: Medium 5.3 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41846](https://cve.now/CVE-2026-41846): Spring Framework Cross-site Scripting via JSP Form Tags - Severity: Medium 5.9 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41845](https://cve.now/CVE-2026-41845): Spring Framework Cross-site Scripting via JavaScriptUtils - Severity: High 7.1 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41844](https://cve.now/CVE-2026-41844): Spring Framework Open Redirect in Spring MVC and WebFlux - Severity: Medium 4.2 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41843](https://cve.now/CVE-2026-41843): Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux - Severity: Medium 5.9 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41842](https://cve.now/CVE-2026-41842): Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux - Severity: High 7.5 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-41841](https://cve.now/CVE-2026-41841): Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux - Severity: Medium 5.9 - Published: Jun 9, 2026 - Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.21; through 5.3.39. - Fixed in 6.2.19 (released Jun 8, 2026, 1 day before disclosure) and 7.0.8 (released Jun 8, 2026, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-22745](https://cve.now/CVE-2026-22745): CVE-2026-22745 : Denial of service in static resource handling on Windows platforms - Severity: Medium 5.3 - Published: Apr 29, 2026 - Affected: from 7.0.0, fixed in 7.0.7; from 6.2.0, fixed in 6.2.18; from 6.1.0, through 6.1.26; through 5.3.47. - Fixed in 6.2.18 (released Apr 17, 2026, 12 days before disclosure) and 7.0.7 (released Apr 17, 2026, 12 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-22741](https://cve.now/CVE-2026-22741): Static resource cache poisoning in Spring MVC and WebFlux - Severity: Low 3.1 - Published: Apr 29, 2026 - Affected: from 7.0.0, fixed in 7.0.7; from 6.2.0, fixed in 6.2.18; from 6.1.0, through 6.1.26; through 5.3.47. - Fixed in 6.2.18 (released Apr 17, 2026, 12 days before disclosure) and 7.0.7 (released Apr 17, 2026, 12 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-22737](https://cve.now/CVE-2026-22737): Spring Framework Improper Path Limitation with Script View Templates - Severity: Medium 5.9 - Published: Mar 19, 2026 - Affected: from 7.0.0-M1, fixed in 7.0.6; from 6.2.0, fixed in 6.2.17; from 6.0.0, through 6.1.21; from 5.3.0, through 5.3.39. - Fixed in 6.2.17 (released Mar 13, 2026, 6 days before disclosure) and 7.0.6 (released Mar 13, 2026, 6 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2026-22735](https://cve.now/CVE-2026-22735): Server Sent Event stream corruption - Severity: Low 2.6 - Published: Mar 19, 2026 - Affected: from 7.0.0-M1, fixed in 7.0.6; from 6.2.0, fixed in 6.2.17; from 6.0.0, through 6.1.21; from 5.3.0, through 5.3.39. - Fixed in 6.2.17 (released Mar 13, 2026, 6 days before disclosure) and 7.0.6 (released Mar 13, 2026, 6 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2025-41242](https://cve.now/CVE-2025-41242): CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers - Severity: Medium 5.9 - Published: Aug 18, 2025 - Affected: from 6.2.0, fixed in 6.2.10; from 6.1.0, through 6.1.21; from 6.0.0, through 6.0.29; from 5.3.0, through 5.3.43. - Fixed in 6.2.10 (released Aug 14, 2025, 4 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2024-38819](https://cve.now/CVE-2024-38819): Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal… - Severity: High 7.5 - Published: Dec 19, 2024 - Affected: from 6.1.0, fixed in 6.1.14; through 5.3.40; from 6.0.0, through 6.0.24. - Fixed in 6.1.14 (released Oct 17, 2024, 63 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2024-38828](https://cve.now/CVE-2024-38828): CVE-2024-38828: DoS via Spring MVC controller method with byte\[\] parameter - Severity: Medium 5.3 - Published: Nov 18, 2024 - Affected: from 5.3.0, fixed in 5.3.42. - Fixed in 6.0.0 (released Nov 16, 2022, 733 days before disclosure, the advisory names 5.3.42, which was never published). - The latest release, 7.0.10, is not affected. ### [CVE-2024-38816](https://cve.now/CVE-2024-38816): CVE-2024-38816: Path traversal vulnerability in functional web frameworks - Severity: High 7.5 - Published: Sep 13, 2024 - Affected: from 6.1.0, fixed in 6.1.13; from 6.0.0, through 6.0.23; from 5.3.0, through 5.3.39. - Fixed in 6.1.13 (released Sep 12, 2024, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2023-34053](https://cve.now/CVE-2023-34053): Spring Framework server Web Observations DoS Vulnerability - Severity: Medium 5.3 - Published: Nov 28, 2023 - Affected: from 6.0.0, fixed in 6.0.14. - Fixed in 6.0.14 (released Nov 16, 2023, 12 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2023-20860](https://cve.now/CVE-2023-20860): Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "\*\*" as a pattern in Spring Security configuration with the… - Severity: High 7.5 - Published: Mar 27, 2023 - Affected: from 6.0.0, fixed in 6.0.7; from 5.3.0, fixed in 5.3.26. - Fixed in 5.3.26 (released Mar 20, 2023, 7 days before disclosure) and 6.0.7 (released Mar 20, 2023, 7 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2022-22965](https://cve.now/CVE-2022-22965): A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. - Severity: Critical 9.8 · KEV - Published: Apr 1, 2022 - Affected: fixed in 5.2.20.RELEASE; from 5.3.0, fixed in 5.3.18. - Fixed in 5.2.20.RELEASE (released Mar 31, 2022, 1 day before disclosure) and 5.3.18 (released Mar 31, 2022, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2020-5397](https://cve.now/CVE-2020-5397): CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux - Severity: Medium 5.3 - Published: Jan 17, 2020 - Affected: from 5.2.0, fixed in 5.2.3. - Fixed in 5.2.3.RELEASE (released Jan 14, 2020, 3 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2020-5398](https://cve.now/CVE-2020-5398): RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application - Severity: High 8.0 - Published: Jan 16, 2020 - Affected: from 5.2.0.RELEASE, fixed in 5.2.3.RELEASE; from 5.1.0.RELEASE, fixed in 5.1.13.RELEASE; from 5.0.0.RELEASE, fixed in 5.0.16.RELEASE. - Fixed in 5.0.16.RELEASE (released Jan 14, 2020, 2 days before disclosure), 5.1.13.RELEASE (released Jan 14, 2020, 2 days before disclosure) and 5.2.3.RELEASE (released Jan 14, 2020, 2 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2014-0225](https://cve.now/CVE-2014-0225): When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported… - Severity: Unrated - Published: May 25, 2017 - Affected: from 4.0.0, fixed in 4.0.5; from 3.0.0, fixed in 3.2.8. - Fixed in 3.2.8.RELEASE (released Feb 19, 2014, 1191 days before disclosure) and 4.0.5.RELEASE (released May 20, 2014, 1101 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2016-9878](https://cve.now/CVE-2016-9878): An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. - Severity: Unrated - Published: Dec 29, 2016 - Affected: fixed in 3.2.18; from 4.2.0, fixed in 4.2.9; from 4.3.0, fixed in 4.3.5. - Fixed in 3.2.18.RELEASE (released Dec 21, 2016, 8 days before disclosure), 4.2.9.RELEASE (released Dec 21, 2016, 8 days before disclosure) and 4.3.5.RELEASE (released Dec 21, 2016, 8 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2014-3625](https://cve.now/CVE-2014-3625): Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before… - Severity: Unrated - Published: Nov 20, 2014 - Affected: from 3.0.4, fixed in 3.2.12; from 4.0.0, fixed in 4.0.8; from 4.1.0, fixed in 4.1.2. - Fixed in 3.2.12.RELEASE (released Nov 11, 2014, 9 days before disclosure), 4.0.8.RELEASE (released Nov 11, 2014, 9 days before disclosure) and 4.1.2.RELEASE (released Nov 11, 2014, 9 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2014-0054](https://cve.now/CVE-2014-0054): The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external… - Severity: Unrated - Published: Apr 17, 2014 - Affected: fixed in 3.2.8; from 4.0.0, fixed in 4.0.2. - Fixed in 3.2.8.RELEASE (released Feb 19, 2014, 57 days before disclosure) and 4.0.2.RELEASE (released Feb 19, 2014, 57 days before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2014-1904](https://cve.now/CVE-2014-1904): Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and… - Severity: Unrated - Published: Mar 20, 2014 - Affected: from 3.0.0, fixed in 3.2.8.RELEASE; from 4.0.0, fixed in 4.0.2.RELEASE. - Fixed in 3.2.8.RELEASE (released Feb 19, 2014, 29 days before disclosure) and 4.0.2.RELEASE (released Feb 19, 2014, 29 days before disclosure). - The latest release, 7.0.10, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.springframework:spring-webmvc Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.