CVE-2026-41844: Spring Framework Open Redirect in Spring MVC and WebFlux
(updated )
A Spring MVC or Spring WebFlux application which configures a mapping for “/**” where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
References
- github.com/advisories/GHSA-h3qp-gqrc-q736
- github.com/spring-projects/spring-framework/commit/3aaec987651cf82fd4ed7e0ed9b3deddcdf58853
- github.com/spring-projects/spring-framework/commit/7add5243b9db13a9f8e765c8ab8545c8e8fe606b
- github.com/spring-projects/spring-framework/releases/tag/v6.2.19
- github.com/spring-projects/spring-framework/releases/tag/v7.0.8
- nvd.nist.gov/vuln/detail/CVE-2026-41844
- spring.io/security/cve-2026-41844
Code Behaviors & Features
Detect and mitigate CVE-2026-41844 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →