CVE-2026-41844: VMware Spring Framework open redirect in MVC and WebFlux

CVE-2026-41844 · Severity: medium · CVSS 4.2 · Published 2026-06-09

Spring Framework, a widely used tool for building Java-based web applications, contains a vulnerability that could allow attackers to redirect users to malicious websites. By tricking a user into clicking a specially crafted link, an attacker can bypass security checks and send the user to an external site that might host phishing content or malware. This issue primarily affects applications with specific broad URL configurations and can damage a company's reputation or lead to credential theft.

Technologies: org.springframework:spring-webflux (Maven), org.springframework:spring-webmvc (Maven), VMware Spring Framework. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41844 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41844 being exploited in the wild.
How severe is CVE-2026-41844?
Medium severity, with a CVSS score of 4.2, published 9 June 2026.
Which products and versions are affected?
org.springframework:spring-webflux (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; org.springframework:spring-webmvc (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Is there a fix for CVE-2026-41844?
Yes. org.springframework:spring-webflux (Maven): upgrade to 7.0.8 or later; org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41844 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41844?
Check whether you run org.springframework:spring-webflux (Maven), org.springframework:spring-webmvc (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework:spring-webflux (Maven): upgrade to 7.0.8 or later
    # set org.springframework:spring-webflux to 7.0.8 in your pom.xml or build.gradle
  • org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later
    # set org.springframework:spring-webmvc to 7.0.8 in your pom.xml or build.gradle

Technical details

An open redirect vulnerability (CWE-601) exists in Spring MVC and Spring WebFlux when a handler mapping is configured for the root pattern '/**' without an explicitly defined view name. In this configuration, the framework may process user-supplied input as a view name, allowing the use of the 'redirect:' prefix to trigger a 302 Found response to an arbitrary external URL. Exploitation requires a remote attacker to entice a user to click a malicious link (User Interaction required). The vulnerability is mitigated by high attack complexity as it depends on specific application routing configurations. Patches are available in versions 7.0.8 and 6.2.19.

Affected products

  • VMware Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48

Identifiers

  • CVE-2026-41844
  • GHSA-h3qp-gqrc-q736

Timeline

  • 2026-06-09: disclosed
  • 2026-06-09: advisory
  • 2026-07-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.