CVE-2026-41003
Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Record
CVE-2026-41003- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-35887
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Record
EUVD-2026-35887- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3pjj-qpw6-5fcm
Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Record
GHSA-3pjj-qpw6-5fcm- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Record
CVE-2026-41003- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Record
CVE-2026-41003- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-3pjj-qpw6-5fcm
Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Record
GHSA-3pjj-qpw6-5fcm- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 23 moreShow less
OSVRHLW-2026-2cf5e53d95861e97
Lightwell Security Advisory: spring-security-saml2-service-provider 5.7.11.rhlw-00006
Red Hat Lightwell has released org.springframework.security:spring-security-saml2-service-provider 5.7.11.rhlw-00006 with backported fixes for CVE-2026-40988, CVE-2026-41003, and CVE-2026-41694.
CVE-2026-40988: Unbounded DEFLATE Inflation in SAML 2.0 Service Provider
CVE-2026-41003: Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
CVE-2026-41694: SAML Payloads Decrypted Without Valid Signature
This patched artifact is a drop-in replacement for org.springframework.security:spring-security-saml2-service-provider 5.7.11 from Maven Central.
- Record
RHLW-2026-2cf5e53d95861e97- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1783645390 No score
TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.8.16-tuxcare.12.
- Record
CLSA-2026-1783645390- Updated
- 2026-11-02
OSVCLSA-2026-1785291983 No score
TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 1 CVE. Fixed in 6.4.3-tuxcare.7.
- Record
CLSA-2026-1785291983- Updated
- 2026-11-02
OSVCLSA-2026-1785727931 No score
TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (3 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 3 CVEs. Fixed in 5.7.12-tuxcare.6.
- Record
CLSA-2026-1785727931- Updated
- 2026-11-02
OSVCLSA-2026-1785965552 No score
TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 5.7.14-tuxcare.4.
- Record
CLSA-2026-1785965552- Updated
- 2026-11-02
OSVCLSA-2026-1786479067 No score
TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 5.6.10-tuxcare.7.
- Record
CLSA-2026-1786479067- Updated
- 2026-11-02
OSVCLSA-2026-1786628763 No score
TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 1 CVE. Fixed in 6.3.10-tuxcare.13.
- Record
CLSA-2026-1786628763- Updated
- 2026-11-02
OSVCLSA-2026-1787137094 No score
TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 1 CVE. Fixed in 5.7.11-tuxcare.6.
- Record
CLSA-2026-1787137094- Updated
- 2026-11-02
OSVCLSA-2026-1787145440 No score
TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 6.2.8-tuxcare.3.
- Record
CLSA-2026-1787145440- Updated
- 2026-11-02
OSVCLSA-2026-1787157249 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 6.4.13-tuxcare.2.
- Record
CLSA-2026-1787157249- Updated
- 2026-11-02
OSVCLSA-2026-1789676383 No score
TuxCare security update for org.springframework.security (8 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 8 CVEs. Fixed in 5.8.14-tuxcare.1.
- Record
CLSA-2026-1789676383- Updated
- 2026-11-02
OSVCLSA-2026-1790159292 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 9 CVEs. Fixed in 6.3.9-tuxcare.1.
- Record
CLSA-2026-1790159292- Updated
- 2026-11-02
OSVCLSA-2026-1790957410 No score
TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 1 CVE. Fixed in 6.2.7-tuxcare.6.
- Record
CLSA-2026-1790957410- Updated
- 2026-11-02
OSVCLSA-2026-1791188726 No score
TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 1 CVE. Fixed in 6.2.2-tuxcare.7.
- Record
CLSA-2026-1791188726- Updated
- 2026-11-02
OSVCLSA-2026-1791380003 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.7.7-tuxcare.1.
- Record
CLSA-2026-1791380003- Updated
- 2026-11-02
OSVCLSA-2026-1791391633 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.5.8-tuxcare.1.
- Record
CLSA-2026-1791391633- Updated
- 2026-11-02
OSVCLSA-2026-1791392813 No score
TuxCare security update for org.springframework.security (10 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.9-tuxcare.1.
- Record
CLSA-2026-1791392813- Updated
- 2026-11-02
OSVCLSA-2026-1792077066 No score
TuxCare security update for org.springframework.security (8 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 8 CVEs. Fixed in 6.0.8-tuxcare.4.
- Record
CLSA-2026-1792077066- Updated
- 2026-11-02
OSVCLSA-2026-1792079446 No score
TuxCare security update for org.springframework.security (15 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.
- Record
CLSA-2026-1792079446- Updated
- 2026-11-02
OSVCLSA-2026-1792079757 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 6.1.6-tuxcare.8.
- Record
CLSA-2026-1792079757- Updated
- 2026-11-02
OSVCLSA-2026-1792084952 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 11 CVEs. Fixed in 5.8.15-tuxcare.2.
- Record
CLSA-2026-1792084952- Updated
- 2026-11-02
OSVCLSA-2026-1792089227 No score
TuxCare security update for org.springframework.security (10 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1.
- Record
CLSA-2026-1792089227- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-41003 No score
CVE-2026-41003 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root
Root has patched CVE-2026-41003 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-41003- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-saml2-service-providerMaven |
7.0.0 to 7.0.5 | 7.0.6 |
org.springframework.security:spring-security-saml2-service-providerMaven |
6.5.0 to 6.5.10 | 6.5.11 |
org.springframework.security:spring-security-saml2-service-providerMaven |
6.4.0 to 6.4.16 | None known |
org.springframework.security:spring-security-saml2-service-providerMaven |
6.3.0 to 6.3.16 | None known |
org.springframework.security:spring-security-saml2-service-providerMaven |
5.8.0 to 5.8.25 | None known |
org.springframework.security:spring-security-saml2-service-providerMaven |
through 5.7.23 | None known |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
5.8.16 up to 5.8.16-tuxcare.12, plus listed versions 5.8.16-tuxcare.105.8.16-tuxcare.115.8.16-tuxcare.45.8.16-tuxcare.55.8.16-tuxcare.6 Show 7 moreShow less5.8.16-tuxcare.75.8.16-tuxcare.85.8.16-tuxcare.95.8.16.tuxcare5.8.16.tuxcare.15.8.16.tuxcare.25.8.16.tuxcare.3 |
5.8.16-tuxcare.12 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.8.16 up to 5.8.16-tuxcare.12, plus listed versions 5.8.16-tuxcare.105.8.16-tuxcare.115.8.16-tuxcare.45.8.16-tuxcare.55.8.16-tuxcare.6 Show 7 moreShow less5.8.16-tuxcare.75.8.16-tuxcare.85.8.16-tuxcare.95.8.16.tuxcare5.8.16.tuxcare.15.8.16.tuxcare.25.8.16.tuxcare.3 |
5.8.16-tuxcare.12 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.4.3 up to 6.4.3-tuxcare.7, plus listed versions 6.4.3-tuxcare.16.4.3-tuxcare.26.4.3-tuxcare.36.4.3-tuxcare.46.4.3-tuxcare.56.4.3-tuxcare.6 |
6.4.3-tuxcare.7 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
5.7.12 up to 5.7.12-tuxcare.6, plus listed versions 5.7.12-tuxcare.15.7.12-tuxcare.25.7.12-tuxcare.35.7.12-tuxcare.45.7.12-tuxcare.5 |
5.7.12-tuxcare.6 |
Show 67 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
5.7.14 up to 5.7.14-tuxcare.4, plus listed versions 5.7.14-tuxcare.15.7.14-tuxcare.25.7.14-tuxcare.3 |
5.7.14-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.7.14 up to 5.7.14-tuxcare.4, plus listed versions 5.7.14-tuxcare.15.7.14-tuxcare.25.7.14-tuxcare.3 |
5.7.14-tuxcare.4 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
5.6.10 up to 5.6.10-tuxcare.7, plus listed versions 5.6.10-tuxcare.15.6.10-tuxcare.25.6.10-tuxcare.35.6.10-tuxcare.45.6.10-tuxcare.55.6.10-tuxcare.6 |
5.6.10-tuxcare.7 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.6.10 up to 5.6.10-tuxcare.7, plus listed versions 5.6.10-tuxcare.15.6.10-tuxcare.25.6.10-tuxcare.35.6.10-tuxcare.45.6.10-tuxcare.55.6.10-tuxcare.6 |
5.6.10-tuxcare.7 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.3.10 up to 6.3.10-tuxcare.13, plus listed versions 6.3.10-tuxcare.16.3.10-tuxcare.106.3.10-tuxcare.116.3.10-tuxcare.126.3.10-tuxcare.2 Show 7 moreShow less6.3.10-tuxcare.36.3.10-tuxcare.46.3.10-tuxcare.56.3.10-tuxcare.66.3.10-tuxcare.76.3.10-tuxcare.86.3.10-tuxcare.9 |
6.3.10-tuxcare.13 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
5.7.11 up to 5.7.11-tuxcare.6, plus listed versions 5.7.11-tuxcare.15.7.11-tuxcare.25.7.11-tuxcare.35.7.11-tuxcare.45.7.11-tuxcare.55.7.11.tuxcare |
5.7.11-tuxcare.6 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.2.8 up to 6.2.8-tuxcare.3, plus listed versions 6.2.8-tuxcare.16.2.8-tuxcare.2 |
6.2.8-tuxcare.3 |
org.springframework.security:spring-security-webTuxCare:Maven |
6.2.8 up to 6.2.8-tuxcare.3, plus listed versions 6.2.8-tuxcare.16.2.8-tuxcare.2 |
6.2.8-tuxcare.3 |
org.springframework.security:spring-security-coreTuxCare:Maven |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven |
5.8.14 up to 5.8.14-tuxcare.1 | 5.8.14-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
5.8.14 up to 5.8.14-tuxcare.1 | 5.8.14-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.8.14 up to 5.8.14-tuxcare.1 | 5.8.14-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.2.7 up to 6.2.7-tuxcare.6, plus listed versions 6.2.7-tuxcare.16.2.7-tuxcare.26.2.7-tuxcare.36.2.7-tuxcare.46.2.7-tuxcare.5 |
6.2.7-tuxcare.6 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.2.2 up to 6.2.2-tuxcare.7, plus listed versions 6.2.2-tuxcare.16.2.2-tuxcare.26.2.2-tuxcare.36.2.2-tuxcare.46.2.2-tuxcare.56.2.2-tuxcare.6 |
6.2.2-tuxcare.7 |
org.springframework.security:spring-security-coreTuxCare:Maven |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven |
6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3 |
6.0.8-tuxcare.4 |
org.springframework.security:spring-security-cryptoTuxCare:Maven |
6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3 |
6.0.8-tuxcare.4 |
org.springframework.security:spring-security-ldapTuxCare:Maven |
6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3 |
6.0.8-tuxcare.4 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3 |
6.0.8-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven |
6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3 |
6.0.8-tuxcare.4 |
org.springframework.security:spring-security-coreTuxCare:Maven |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven |
6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7 |
6.1.6-tuxcare.8 |
org.springframework.security:spring-security-cryptoTuxCare:Maven |
6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7 |
6.1.6-tuxcare.8 |
org.springframework.security:spring-security-ldapTuxCare:Maven |
6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7 |
6.1.6-tuxcare.8 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7 |
6.1.6-tuxcare.8 |
org.springframework.security:spring-security-webTuxCare:Maven |
6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7 |
6.1.6-tuxcare.8 |
org.springframework.security:spring-security-coreTuxCare:Maven |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-cryptoTuxCare:Maven |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-ldapTuxCare:Maven |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven |
5.6.7 up to 5.6.7-tuxcare.1 | 5.6.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven |
5.6.7 up to 5.6.7-tuxcare.1 | 5.6.7-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven |
5.6.7 up to 5.6.7-tuxcare.1 | 5.6.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
5.6.7 up to 5.6.7-tuxcare.1 | 5.6.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven |
5.6.7 up to 5.6.7-tuxcare.1 | 5.6.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerMaven |
7.0.0 up to 7.0.6, plus listed versions 7.0.17.0.27.0.37.0.47.0.5 |
7.0.6 |
org.springframework.security:spring-security-saml2-service-providerMaven |
6.5.0 up to 6.5.11, plus listed versions 6.5.16.5.106.5.26.5.36.5.4 Show 5 moreShow less6.5.56.5.66.5.76.5.86.5.9 |
6.5.11 |
org.springframework.security:spring-security-saml2-service-providerMaven |
6.4.0 to 6.4.16, plus listed versions 6.4.16.4.106.4.116.4.126.4.13 Show 8 moreShow less6.4.26.4.36.4.46.4.56.4.66.4.76.4.86.4.9 |
None known |
org.springframework.security:spring-security-saml2-service-providerMaven |
6.3.0 to 6.3.16, plus listed versions 6.3.16.3.106.3.26.3.36.3.4 Show 5 moreShow less6.3.56.3.66.3.76.3.86.3.9 |
None known |
org.springframework.security:spring-security-saml2-service-providerMaven |
5.8.0 to 5.8.25, plus listed versions 5.8.15.8.105.8.115.8.125.8.13 Show 11 moreShow less5.8.145.8.155.8.165.8.25.8.35.8.45.8.55.8.65.8.75.8.85.8.9 |
None known |
org.springframework.security:spring-security-saml2-service-providerMaven |
through 5.7.23, plus listed versions 5.2.0.RELEASE5.2.1.RELEASE5.2.10.RELEASE5.2.11.RELEASE5.2.12.RELEASE Show 45 moreShow less5.2.13.RELEASE5.2.14.RELEASE5.2.15.RELEASE5.2.2.RELEASE5.2.3.RELEASE5.2.4.RELEASE5.2.5.RELEASE5.2.6.RELEASE5.2.7.RELEASE5.2.8.RELEASE5.2.9.RELEASE5.3.0.RELEASE5.3.1.RELEASE5.3.10.RELEASE5.3.11.RELEASE5.3.12.RELEASE5.3.13.RELEASE5.3.2.RELEASE5.3.3.RELEASE5.3.4.RELEASE5.3.5.RELEASE5.3.6.RELEASE5.3.7.RELEASE5.3.8.RELEASE5.3.9.RELEASE5.4.05.4.15.4.105.4.115.4.25.4.35.4.45.4.55.4.65.4.75.4.85.4.95.5.05.5.15.5.25.5.35.5.45.5.55.5.65.5.7 |
None known |
org.springframework.security:spring-security-saml2-service-providerRed Hat Lightwell:Maven |
before 5.7.11.rhlw-00006, plus listed versions 5.2.0.RELEASE5.2.1.RELEASE5.2.10.RELEASE5.2.11.RELEASE5.2.12.RELEASE Show 45 moreShow less5.2.13.RELEASE5.2.14.RELEASE5.2.15.RELEASE5.2.2.RELEASE5.2.3.RELEASE5.2.4.RELEASE5.2.5.RELEASE5.2.6.RELEASE5.2.7.RELEASE5.2.8.RELEASE5.2.9.RELEASE5.3.0.RELEASE5.3.1.RELEASE5.3.10.RELEASE5.3.11.RELEASE5.3.12.RELEASE5.3.13.RELEASE5.3.2.RELEASE5.3.3.RELEASE5.3.4.RELEASE5.3.5.RELEASE5.3.6.RELEASE5.3.7.RELEASE5.3.8.RELEASE5.3.9.RELEASE5.4.05.4.15.4.105.4.115.4.25.4.35.4.45.4.55.4.65.4.75.4.85.4.95.5.05.5.15.5.25.5.35.5.45.5.55.5.65.5.7 |
5.7.11.rhlw-00006 |
org.springframework.security:spring-security-saml2-service-providerRoot:Maven |
before 6.5.9-aikido.1 | 6.5.9-aikido.17.0.4-aikido.1 |
io.root.org.springframework.security:spring-security-saml2-service-providerRoot:Maven |
before 6.5.9-root.io.1 | 6.5.9-root.io.17.0.4-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, affected_more | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41003 is a high vulnerability (CVSS 7.6) in Spring Security, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in org.springframework.security:spring-security-saml2-service-provider 7.0.6.
References
spring.io/security/cve-2026-41003
nvd.nist.gov/vuln/detail/CVE-2026-41003
github.com/spring-projects/spring-security/releases/tag/6.5.11
Show 9 moreShow less
Left out here: 55 versions. The JSON record has them.