# org.springframework:spring-webmvc (Maven) vulnerabilities Source: https://junglewise.ai/threats/technologies/org-springframework-spring-webmvc Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/org-springframework-spring-webmvc.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 27 vulnerabilities in org.springframework:spring-webmvc (Maven): 0 in the last 7 days and 2 in the last 90 days, 3 of them critical and 1 exploited in the wild. The most recent, CVE-2026-47890, was published on 27 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 2 - All time: 27 (3 critical, 1 exploited in the wild) ## About org.springframework:spring-webmvc (Maven) A Model-View-Controller framework for building web applications within the Spring ecosystem. ## Latest org.springframework:spring-webmvc (Maven) vulnerabilities - [CVE-2026-47890: Spring Framework Server Sent Event stream corruption while rendering fragments](https://junglewise.ai/threats/cve-2026-47890-spring-framework-server-sent-event-stream-corruption-while) (critical, CVSS 9.8, published 27 Aug 2026) - [CVE-2026-47884: Spring Framework SSRF and RCE in XsltView](https://junglewise.ai/threats/cve-2026-47884-spring-framework-ssrf-and-rce-in-xsltview) (critical, CVSS 9.8, published 27 Aug 2026) - [CVE-2026-41842: VMware Spring Framework denial of service in static resource resolution](https://junglewise.ai/threats/cve-2026-41842-vmware-spring-framework-dos-in-static-resource-resolution) (high, CVSS 7.5, published 9 Jun 2026) - [CVE-2026-41853: VMware Spring Framework multipart request smuggling in MVC and WebFlux](https://junglewise.ai/threats/cve-2026-41853-vmware-spring-framework-multipart-request-smuggling-in-mvc-and) (medium, CVSS 5.3, published 9 Jun 2026) - [CVE-2026-41846: VMware Spring Framework XSS in JSP form tags](https://junglewise.ai/threats/cve-2026-41846-vmware-spring-framework-xss-in-jsp-form-tags) (medium, CVSS 5.9, published 9 Jun 2026) - [CVE-2026-41845: VMware Spring Framework XSS in JavaScriptUtils](https://junglewise.ai/threats/cve-2026-41845-vmware-spring-framework-xss-in-javascriptutils) (high, CVSS 7.1, published 9 Jun 2026) - [CVE-2026-41844: VMware Spring Framework open redirect in MVC and WebFlux](https://junglewise.ai/threats/cve-2026-41844-vmware-spring-framework-open-redirect-in-mvc-and-webflux) (medium, CVSS 4.2, published 9 Jun 2026) - [CVE-2026-41843: VMware Spring Framework path traversal in static resource resolution](https://junglewise.ai/threats/cve-2026-41843-vmware-spring-framework-path-traversal-in-static-resource) (medium, CVSS 5.9, published 9 Jun 2026) - [CVE-2026-41841: VMware Spring Framework information disclosure in static resource resolution](https://junglewise.ai/threats/cve-2026-41841-vmware-spring-framework-information-disclosure-in-static-resource) (medium, CVSS 5.9, published 9 Jun 2026) - [CVE-2026-22745: Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources](https://junglewise.ai/threats/cve-2026-22745-spring-mvc-and-webflux-applications-are-vulnerable-to-denial-of) (medium, CVSS 5.3, published 29 Apr 2026) - [CVE-2026-22741: Spring Framework cache poisoning in static resource resolution](https://junglewise.ai/threats/cve-2026-22741-spring-framework-cache-poisoning-in-static-resource-resolution) (low, CVSS 3.1, published 29 Apr 2026) - [CVE-2026-22735: Spring MVC and WebFlux has Server Sent Event stream corruption](https://junglewise.ai/threats/cve-2026-22735-spring-mvc-and-webflux-has-server-sent-event-stream-corruption) (low, CVSS 3.1, published 20 Mar 2026) - [CVE-2026-22737: Spring Framework Improper Path Limitation with Script View Templates](https://junglewise.ai/threats/cve-2026-22737-spring-framework-improper-path-limitation-with-script-view) (low, CVSS 3.1, published 20 Mar 2026) - [CVE-2025-41242: Spring Framework MVC Applications Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2025-41242-spring-framework-mvc-applications-path-traversal-vulnerability) (low, CVSS 3.1, published 18 Aug 2025) - [CVE-2024-38819: Spring Framework Path Traversal vulnerability](https://junglewise.ai/threats/cve-2024-38819-spring-framework-path-traversal-vulnerability) (high, CVSS 7.5, published 19 Dec 2024) - [CVE-2024-38828: Spring MVC controller vulnerable to a DoS attack](https://junglewise.ai/threats/cve-2024-38828-spring-mvc-controller-vulnerable-to-a-dos-attack) (low, CVSS 3.1, published 18 Nov 2024) - [CVE-2024-38816: Path traversal vulnerability in functional web frameworks](https://junglewise.ai/threats/cve-2024-38816-path-traversal-vulnerability-in-functional-web-frameworks) (low, CVSS 3.1, published 13 Sep 2024) - [CVE-2023-34053: Spring Framework vulnerable to denial of service](https://junglewise.ai/threats/cve-2023-34053-spring-framework-vulnerable-to-denial-of-service) (low, CVSS 3.1, published 28 Nov 2023) - [CVE-2023-20860: Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch](https://junglewise.ai/threats/cve-2023-20860-spring-framework-is-vulnerable-to-security-bypass-via) (low, CVSS 3.1, published 28 Mar 2023) - [CVE-2014-1904: Improper Neutralization of Input During Web Page Generation in Spring Framework](https://junglewise.ai/threats/cve-2014-1904-improper-neutralization-of-input-during-web-page-generation-in) (info, published 14 May 2022) - [CVE-2014-0225: Improper Restriction of XML External Entity Reference in Spring Framework](https://junglewise.ai/threats/cve-2014-0225-improper-restriction-of-xml-external-entity-reference-in-spring) (low, CVSS 3, published 13 May 2022) - [CVE-2014-3625: Improper Limitation of a Pathname to a Restricted Directory in Spring Framework](https://junglewise.ai/threats/cve-2014-3625-improper-limitation-of-a-pathname-to-a-restricted-directory-in) (info, published 13 May 2022) - [CVE-2014-0054: Cross-Site Request Forgery in Spring Framework](https://junglewise.ai/threats/cve-2014-0054-cross-site-request-forgery-in-spring-framework) (info, published 13 May 2022) - [CVE-2022-22965: Remote Code Execution in Spring Framework](https://junglewise.ai/threats/cve-2022-22965-spring-framework-jdk-9-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 31 Mar 2022) - [CVE-2020-5397: CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux](https://junglewise.ai/threats/cve-2020-5397-csrf-attack-via-cors-preflight-requests-with-spring-mvc-or-spring) (low, CVSS 3, published 21 Jan 2020) ## Most severe org.springframework:spring-webmvc (Maven) vulnerabilities - [CVE-2022-22965: Remote Code Execution in Spring Framework](https://junglewise.ai/threats/cve-2022-22965-spring-framework-jdk-9-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 31 Mar 2022) - [CVE-2026-47884: Spring Framework SSRF and RCE in XsltView](https://junglewise.ai/threats/cve-2026-47884-spring-framework-ssrf-and-rce-in-xsltview) (critical, CVSS 9.8, published 27 Aug 2026) - [CVE-2026-47890: Spring Framework Server Sent Event stream corruption while rendering fragments](https://junglewise.ai/threats/cve-2026-47890-spring-framework-server-sent-event-stream-corruption-while) (critical, CVSS 9.8, published 27 Aug 2026) - [CVE-2024-38819: Spring Framework Path Traversal vulnerability](https://junglewise.ai/threats/cve-2024-38819-spring-framework-path-traversal-vulnerability) (high, CVSS 7.5, published 19 Dec 2024) - [CVE-2026-41842: VMware Spring Framework denial of service in static resource resolution](https://junglewise.ai/threats/cve-2026-41842-vmware-spring-framework-dos-in-static-resource-resolution) (high, CVSS 7.5, published 9 Jun 2026) - [CVE-2026-41845: VMware Spring Framework XSS in JavaScriptUtils](https://junglewise.ai/threats/cve-2026-41845-vmware-spring-framework-xss-in-javascriptutils) (high, CVSS 7.1, published 9 Jun 2026) - [CVE-2026-41843: VMware Spring Framework path traversal in static resource resolution](https://junglewise.ai/threats/cve-2026-41843-vmware-spring-framework-path-traversal-in-static-resource) (medium, CVSS 5.9, published 9 Jun 2026) - [CVE-2026-41841: VMware Spring Framework information disclosure in static resource resolution](https://junglewise.ai/threats/cve-2026-41841-vmware-spring-framework-information-disclosure-in-static-resource) (medium, CVSS 5.9, published 9 Jun 2026) - [CVE-2026-41846: VMware Spring Framework XSS in JSP form tags](https://junglewise.ai/threats/cve-2026-41846-vmware-spring-framework-xss-in-jsp-form-tags) (medium, CVSS 5.9, published 9 Jun 2026) - [CVE-2026-22745: Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources](https://junglewise.ai/threats/cve-2026-22745-spring-mvc-and-webflux-applications-are-vulnerable-to-denial-of) (medium, CVSS 5.3, published 29 Apr 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 2 | 2 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Maven technologies - [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core): 259 vulnerabilities - [org.apache.tomcat:tomcat (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat): 169 vulnerabilities - [com.liferay.portal:release.portal.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom): 159 vulnerabilities - [com.liferay.portal:release.dxp.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom): 125 vulnerabilities - [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services): 122 vulnerabilities - [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind): 86 vulnerabilities - [org.apache.tomcat.embed:tomcat-embed-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core): 83 vulnerabilities - [org.apache.struts:struts2-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core): 60 vulnerabilities - [org.keycloak:keycloak-core (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core): 57 vulnerabilities - [org.xwiki.platform:xwiki-platform-oldcore (Maven)](https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore): 46 vulnerabilities - [org.apache.tomcat:tomcat-catalina (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina): 44 vulnerabilities - [org.elasticsearch:elasticsearch (Maven)](https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch): 41 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "org.springframework:spring-webmvc (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/org-springframework-spring-webmvc, 9 November 2026.