CVE-2026-41844: Open Redirect Vulnerability in Spring MVC and WebFlux
Summary
CVE-2026-41844: Spring Framework Open Redirect in Spring MVC and WebFlux. Affects org.springframework:spring-webmvc across 4 version ranges.
< 5.3.39
>= 6.1.0, <= 6.1.21
>= 6.2.0, < 6.2.19
>= 7.0.0, < 7.0.8
Fixed in 5.3.39, 6.2.19 or 7.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Framework is a powerful framework for building Java applications, particularly web applications. It provides comprehensive infrastructure support for developing Java applications. The Spring MVC and WebFlux modules are designed for creating web applications with a focus on flexibility and ease of use. However, certain configurations can expose applications to security vulnerabilities, such as open redirects, which can lead to phishing attacks and other malicious activities.
Vulnerability Detail
The vulnerability arises from a misconfiguration in Spring MVC and WebFlux applications that map requests to the path '/**' without explicitly specifying a view name. This allows attackers to craft URLs that redirect users to arbitrary external hosts using the 'redirect:' prefix. The potential ramifications include unauthorized access to sensitive information and exploitation of users through phishing attacks. The vulnerability affects multiple versions of the Spring Framework, making it critical for developers to address it promptly.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.3.395.3.39 -
>= 6.2.0, < 6.2.196.2.19 -
>= 7.0.0, < 7.0.87.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement a custom redirect handler that validates the redirect URL against a whitelist of allowed domains. This can prevent unauthorized redirects while you work on applying the patch.
Conclusion
The CVE-2026-41844 vulnerability in Spring MVC and WebFlux poses a significant risk due to its potential for exploitation through open redirects. Developers are urged to update their packages to the latest patched versions and implement necessary workarounds to safeguard their applications against this threat.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
An open redirect vulnerability occurs when an application accepts a user-controlled input that specifies a URL to redirect to, allowing attackers to redirect users to malicious sites.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your pom.xml, it can help you determine if your application is affected by this vulnerability.
Failure to address this vulnerability can lead to phishing attacks, where users are tricked into providing sensitive information to malicious sites, potentially resulting in data breaches.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 4.2, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
