# CVE-2026-41847: VMware Spring Framework security bypass in WebFlux Kotlin Router DSL

Source: https://junglewise.ai/threats/cve-2026-41847-vmware-spring-framework-security-bypass-in-webflux-kotlin-router  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-41847 · Severity: medium · CVSS 4.8 · Published 2026-06-09

Spring Framework is a popular tool used by developers to build Java-based web applications. A security flaw has been identified in its WebFlux component when using the Kotlin programming language to define web routes. This vulnerability could allow an attacker to bypass security filters, potentially gaining unauthorized access to restricted parts of the application or its data.

Technologies: [org.springframework:spring-webflux (Maven)](https://junglewise.ai/threats/technologies/org-springframework-spring-webflux), [VMware Spring Framework](https://junglewise.ai/threats/technologies/spring-framework). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41847 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41847 being exploited in the wild.

**How severe is CVE-2026-41847?** Medium severity, with a CVSS score of 4.8, published 9 June 2026.

**Which products and versions are affected?** org.springframework:spring-webflux (Maven) <= 5.3.39, ECOSYSTEM:introduced=0,last_affected=5.3.39; VMware Spring Framework 5.3.0 through 5.3.48.

**Is there a fix for CVE-2026-41847?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41847 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41847?** Check whether you run org.springframework:spring-webflux (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A security filter bypass vulnerability exists in Spring Framework's WebFlux component, specifically affecting applications utilizing the Kotlin Router DSL. The flaw is classified as Improper Access Control (CWE-284) and occurs when security constraints are incorrectly applied or bypassed due to the way routes are handled in the Kotlin DSL. An unauthenticated attacker can exploit this over the network, though the attack complexity is rated as high. Successful exploitation could lead to a partial loss of confidentiality and integrity. The vulnerability affects Spring Framework versions 5.3.0 through 5.3.48; users are advised to monitor for patches (e.g., version 5.3.49).

## Affected products

- VMware Spring Framework 5.3.0 through 5.3.48

## Identifiers

- CVE-2026-41847
- GHSA-vqgp-pf68-6947

## Timeline

- 2026-06-09: disclosed: NVD and GitHub Advisory published
- 2026-07-30: advisory: GitHub Advisory updated and reviewed

## References

- [https://spring.io/security/cve-2026-41847](https://spring.io/security/cve-2026-41847)

## Related threats

- [Spring Framework stream corruption in Server-Sent Events](https://junglewise.ai/threats/cve-2026-59313-spring-framework-stream-corruption-in-server-sent-events)
- [Spring Framework Server Sent Event stream corruption while rendering fragments](https://junglewise.ai/threats/cve-2026-47890-spring-framework-server-sent-event-stream-corruption-while)
- [Spring Framework information disclosure in WebSocket exception handling](https://junglewise.ai/threats/cve-2026-47893-spring-framework-information-disclosure-in-websocket-exception)
- [Spring Framework header predicate bypass in WebFlux functional endpoints](https://junglewise.ai/threats/cve-2026-47892-spring-framework-header-predicate-bypass-in-webflux-functional)
- [Spring Framework XML maxInMemorySize enforcement bypass](https://junglewise.ai/threats/cve-2026-47891-spring-framework-xml-maxinmemorysize-enforcement-bypass)