CVE-2026-41847

Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL

4.8 Medium

What does this mean?

: 4.8v3.1, from CVE List
: 0.17%5th percentile
Published: June 9, 2026
Modified: November 6, 2026
Weakness: CWE-284
Also known as: CLSA-2026-1785939604CLSA-2026-1785954263CLSA-2026-1785957662CLSA-2026-1785969383CLSA-2026-1786339580CLSA-2026-1786552823CLSA-2026-1786609560CLSA-2026-1787246263
Show 23 moreShow less
CLSA-2026-1787317970CLSA-2026-1788372470CLSA-2026-1789427454CLSA-2026-1790070671CLSA-2026-1790234279CLSA-2026-1793615948CLSA-2026-1793616969CLSA-2026-1793620971CLSA-2026-1793630574CLSA-2026-1793632081CLSA-2026-1793638642CLSA-2026-1793881978CLSA-2026-1793883499CLSA-2026-1793884148CLSA-2026-1793884738CLSA-2026-1793885497DEBIAN-CVE-2026-41847EUVD-2026-35335GHSA-cx7f-g6mp-7hqmGHSA-g5vr-rgqm-vf78GHSA-vqgp-pf68-6947RHLW-2026-8ef16ddaa2e22182UBUNTU-CVE-2026-41847

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.

Affected versions: Spring Framework 5.3.0 through 5.3.48.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.17%Up 0.1 points since Jun 9, 2026

What each source reports

CVE List Score used 4.8

Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.

Affected versions: Spring Framework 5.3.0 through 5.3.48.

Record: CVE-2026-41847
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2026-35335 4.8

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.

Affected versions: Spring Framework 5.3.0 through 5.3.48.

Record: EUVD-2026-35335
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-vqgp-pf68-6947 4.8

Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.

Affected versions: Spring Framework 5.3.0 through 5.3.48.

Record: GHSA-vqgp-pf68-6947
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

NVD 4.8

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.

Affected versions: Spring Framework 5.3.0 through 5.3.48.

Record: CVE-2026-41847
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-41847 5.3

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.

Record: DEBIAN-CVE-2026-41847
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVGHSA-vqgp-pf68-6947 4.8

Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.

Affected versions: Spring Framework 5.3.0 through 5.3.48.

Record: GHSA-vqgp-pf68-6947
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-284
Updated: 2026-11-02

Show 26 moreShow less

OSVUBUNTU-CVE-2026-41847 4.8

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.

Record: UBUNTU-CVE-2026-41847
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVCLSA-2026-1785939604 No score

TuxCare security update for org.springframework (9 CVEs)

TuxCare rebuilt 6 org.springframework packages to address 9 CVEs. Fixed in 5.3.30-tuxcare.5.

Record: CLSA-2026-1785939604
Updated: 2026-11-02

OSVCLSA-2026-1785954263 No score

TuxCare security update for org.springframework (9 CVEs)

TuxCare rebuilt 5 org.springframework packages to address 9 CVEs. Fixed in 5.3.37-tuxcare.9.

Record: CLSA-2026-1785954263
Updated: 2026-11-02

OSVCLSA-2026-1785957662 No score

TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 4 org.springframework packages to address 7 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.7.

Record: CLSA-2026-1785957662
Updated: 2026-11-02

OSVCLSA-2026-1785969383 No score

TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 2 org.springframework packages to address 4 CVEs. Fixed in 5.3.39-tuxcare.18.

Record: CLSA-2026-1785969383
Updated: 2026-11-02

OSVCLSA-2026-1786339580 No score

TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 2 org.springframework packages to address 4 CVEs. Fixed in 5.3.24-tuxcare.5.

Record: CLSA-2026-1786339580
Updated: 2026-11-02

OSVCLSA-2026-1786552823 No score

TuxCare security update for org.springframework (10 CVEs)

TuxCare rebuilt 5 org.springframework packages to address 10 CVEs. Fixed in 5.3.7-tuxcare.5.

Record: CLSA-2026-1786552823
Updated: 2026-11-02

OSVCLSA-2026-1786609560 No score

TuxCare security update for org.grails (18 CVEs)

TuxCare rebuilt 33 org.grails packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1.

Record: CLSA-2026-1786609560
Updated: 2026-11-02

OSVCLSA-2026-1787246263 No score

TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 5 org.springframework packages to address 7 CVEs. Fixed in 5.3.29-tuxcare.6.

Record: CLSA-2026-1787246263
Updated: 2026-11-02

OSVCLSA-2026-1787317970 No score

TuxCare security update for org.springframework (5 CVEs)

TuxCare rebuilt 3 org.springframework packages to address 5 CVEs. Fixed in 5.3.31-tuxcare.11.

Record: CLSA-2026-1787317970
Updated: 2026-11-02

OSVCLSA-2026-1788372470 No score

TuxCare security update for org.springframework (21 CVEs)

TuxCare rebuilt 7 org.springframework packages to address 21 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.4.

Record: CLSA-2026-1788372470
Updated: 2026-11-02

OSVCLSA-2026-1789427454 No score

TuxCare security update for org.springframework (18 CVEs)

TuxCare rebuilt 9 org.springframework packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1.

Record: CLSA-2026-1789427454
Updated: 2026-11-02

OSVCLSA-2026-1790070671 No score

TuxCare security update for org.springframework (32 CVEs)

TuxCare rebuilt 11 org.springframework packages to address 32 CVEs. Fixed in 5.3.33-tuxcare.1.

Record: CLSA-2026-1790070671
Updated: 2026-11-02

OSVCLSA-2026-1790234279 No score

TuxCare security update for org.springframework (27 CVEs)

TuxCare rebuilt 8 org.springframework packages to address 27 CVEs. Fixed in 5.2.17.RELEASE-tuxcare.1.

Record: CLSA-2026-1790234279
Updated: 2026-11-02

OSVCLSA-2026-1793615948 No score

TuxCare security update for org.springframework (17 CVEs)

TuxCare rebuilt 9 org.springframework packages to address 17 CVEs. Fixed in 5.2.7.RELEASE-tuxcare.3.

Record: CLSA-2026-1793615948
Updated: 2026-11-02

OSVCLSA-2026-1793616969 No score

TuxCare security update for org.springframework (16 CVEs)

TuxCare rebuilt 9 org.springframework packages to address 16 CVEs. Fixed in 5.2.9.RELEASE-tuxcare.2.

Record: CLSA-2026-1793616969
Updated: 2026-11-02

OSVCLSA-2026-1793620971 No score

TuxCare security update for org.springframework (13 CVEs)

TuxCare rebuilt 8 org.springframework packages to address 13 CVEs. Fixed in 5.2.10.RELEASE-tuxcare.3.

Record: CLSA-2026-1793620971
Updated: 2026-11-02

OSVCLSA-2026-1793630574 No score

TuxCare security update for org.springframework (10 CVEs)

TuxCare rebuilt 7 org.springframework packages to address 10 CVEs. Fixed in 5.3.23-tuxcare.4.

Record: CLSA-2026-1793630574
Updated: 2026-11-02

OSVCLSA-2026-1793632081 No score

TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 6 org.springframework packages to address 7 CVEs. Fixed in 5.3.13-tuxcare.5.

Record: CLSA-2026-1793632081
Updated: 2026-11-02

OSVCLSA-2026-1793638642 No score

TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 4 org.springframework packages to address 3 CVEs. Fixed in 5.2.25.RELEASE-tuxcare.4.

Record: CLSA-2026-1793638642
Updated: 2026-11-02

OSVCLSA-2026-1793881978 No score

TuxCare security update for org.springframework (8 CVEs)

TuxCare rebuilt 5 org.springframework packages to address 8 CVEs. Fixed in 5.3.20-tuxcare.4.

Record: CLSA-2026-1793881978
Updated: 2026-11-06

OSVCLSA-2026-1793883499 No score

TuxCare security update for org.springframework (18 CVEs)

TuxCare rebuilt 8 org.springframework packages to address 18 CVEs. Fixed in 5.2.8.RELEASE-tuxcare.3.

Record: CLSA-2026-1793883499
Updated: 2026-11-06

OSVCLSA-2026-1793884148 No score

TuxCare security update for org.springframework (8 CVEs)

TuxCare rebuilt 7 org.springframework packages to address 8 CVEs. Fixed in 5.3.3-tuxcare.4.

Record: CLSA-2026-1793884148
Updated: 2026-11-06

OSVCLSA-2026-1793884738 No score

TuxCare security update for org.springframework (14 CVEs)

TuxCare rebuilt 8 org.springframework packages to address 14 CVEs. Fixed in 5.3.5-tuxcare.3.

Record: CLSA-2026-1793884738
Updated: 2026-11-06

OSVCLSA-2026-1793885497 No score

TuxCare security update for org.springframework (13 CVEs)

TuxCare rebuilt 7 org.springframework packages to address 13 CVEs. Fixed in 5.2.11.RELEASE-tuxcare.4.

Record: CLSA-2026-1793885497
Updated: 2026-11-06

OSVRHLW-2026-8ef16ddaa2e22182 No score

Lightwell Security Advisory: spring-webflux 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-webflux 5.3.18.rhlw-00010 with backported fixes for CVE-2024-38816, CVE-2024-38819, CVE-2026-22735, CVE-2026-22737, CVE-2026-22740, CVE-2026-22741, CVE-2026-22745, CVE-2026-41839, CVE-2026-41840, CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41847, CVE-2026-41853, and CVE-2026-47892.

CVE-2024-38816: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Specifically, an application is vulnerable when both of the following are true:

the web application uses RouterFunctions to serve static resources
resource handling is explicitly configured with a FileSystemResource location

However, malicious requests are blocked and rejected when any of the following is true:

the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html is in use
the application runs on Tomcat or Jetty

CVE-2024-38819: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

This patched artifact is a drop-in replacement for org.springframework:spring-webflux 5.3.18 from Maven Central.

Record: RHLW-2026-8ef16ddaa2e22182
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework:spring-webflux` Maven	through 5.3.39	None known
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 9 CVEs	5.3.30 up to 5.3.30-tuxcare.5, plus listed versions 5.3.30-tuxcare.15.3.30-tuxcare.25.3.30-tuxcare.35.3.30-tuxcare.4	5.3.30-tuxcare.5
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 9 CVEs	5.3.30 up to 5.3.30-tuxcare.5, plus listed versions 5.3.30-tuxcare.15.3.30-tuxcare.25.3.30-tuxcare.35.3.30-tuxcare.4	5.3.30-tuxcare.5
`org.springframework:spring-jms` TuxCare:Maven From an advisory covering 9 CVEs	5.3.30 up to 5.3.30-tuxcare.5, plus listed versions 5.3.30-tuxcare.15.3.30-tuxcare.25.3.30-tuxcare.35.3.30-tuxcare.4	5.3.30-tuxcare.5
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 9 CVEs	5.3.30 up to 5.3.30-tuxcare.5, plus listed versions 5.3.30-tuxcare.15.3.30-tuxcare.25.3.30-tuxcare.35.3.30-tuxcare.4	5.3.30-tuxcare.5
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 9 CVEs	5.3.30 up to 5.3.30-tuxcare.5, plus listed versions 5.3.30-tuxcare.15.3.30-tuxcare.25.3.30-tuxcare.35.3.30-tuxcare.4	5.3.30-tuxcare.5
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 9 CVEs	5.3.30 up to 5.3.30-tuxcare.5, plus listed versions 5.3.30-tuxcare.15.3.30-tuxcare.25.3.30-tuxcare.35.3.30-tuxcare.4	5.3.30-tuxcare.5
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 9 CVEs	5.3.37 up to 5.3.37-tuxcare.9, plus listed versions 5.3.37-tuxcare.15.3.37-tuxcare.25.3.37-tuxcare.35.3.37-tuxcare.45.3.37-tuxcare.55.3.37-tuxcare.65.3.37-tuxcare.75.3.37-tuxcare.8	5.3.37-tuxcare.9
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 9 CVEs	5.3.37 up to 5.3.37-tuxcare.9, plus listed versions 5.3.37-tuxcare.15.3.37-tuxcare.25.3.37-tuxcare.35.3.37-tuxcare.45.3.37-tuxcare.55.3.37-tuxcare.65.3.37-tuxcare.75.3.37-tuxcare.8	5.3.37-tuxcare.9
`org.springframework:spring-jms` TuxCare:Maven From an advisory covering 9 CVEs	5.3.37 up to 5.3.37-tuxcare.9, plus listed versions 5.3.37-tuxcare.15.3.37-tuxcare.25.3.37-tuxcare.35.3.37-tuxcare.45.3.37-tuxcare.55.3.37-tuxcare.65.3.37-tuxcare.75.3.37-tuxcare.8	5.3.37-tuxcare.9

Show 150 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 9 CVEs	5.3.37 up to 5.3.37-tuxcare.9, plus listed versions 5.3.37-tuxcare.15.3.37-tuxcare.25.3.37-tuxcare.35.3.37-tuxcare.45.3.37-tuxcare.55.3.37-tuxcare.65.3.37-tuxcare.75.3.37-tuxcare.8	5.3.37-tuxcare.9
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 9 CVEs	5.3.37 up to 5.3.37-tuxcare.9, plus listed versions 5.3.37-tuxcare.15.3.37-tuxcare.25.3.37-tuxcare.35.3.37-tuxcare.45.3.37-tuxcare.55.3.37-tuxcare.65.3.37-tuxcare.75.3.37-tuxcare.8	5.3.37-tuxcare.9
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 7 CVEs	5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6	5.2.13.RELEASE-tuxcare.7
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 7 CVEs	5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6	5.2.13.RELEASE-tuxcare.7
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 7 CVEs	5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6	5.2.13.RELEASE-tuxcare.7
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 7 CVEs	5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6	5.2.13.RELEASE-tuxcare.7
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 4 CVEs	5.3.39 up to 5.3.39-tuxcare.18, plus listed versions 5.3.39-tuxcare.105.3.39-tuxcare.115.3.39-tuxcare.125.3.39-tuxcare.135.3.39-tuxcare.14 Show 11 moreShow less 5.3.39-tuxcare.155.3.39-tuxcare.165.3.39-tuxcare.175.3.39-tuxcare.75.3.39-tuxcare.85.3.39-tuxcare.95.3.39.tuxcare.15.3.39.tuxcare.35.3.39.tuxcare.45.3.39.tuxcare.55.3.39.tuxcare.6	5.3.39-tuxcare.18
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 4 CVEs	5.3.39 up to 5.3.39-tuxcare.18, plus listed versions 5.3.39-tuxcare.105.3.39-tuxcare.115.3.39-tuxcare.125.3.39-tuxcare.135.3.39-tuxcare.14 Show 11 moreShow less 5.3.39-tuxcare.155.3.39-tuxcare.165.3.39-tuxcare.175.3.39-tuxcare.75.3.39-tuxcare.85.3.39-tuxcare.95.3.39.tuxcare.15.3.39.tuxcare.35.3.39.tuxcare.45.3.39.tuxcare.55.3.39.tuxcare.6	5.3.39-tuxcare.18
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 4 CVEs	5.3.24 up to 5.3.24-tuxcare.5, plus listed versions 5.3.24-tuxcare.15.3.24-tuxcare.25.3.24-tuxcare.35.3.24-tuxcare.4	5.3.24-tuxcare.5
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 4 CVEs	5.3.24 up to 5.3.24-tuxcare.5, plus listed versions 5.3.24-tuxcare.15.3.24-tuxcare.25.3.24-tuxcare.35.3.24-tuxcare.4	5.3.24-tuxcare.5
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 10 CVEs	5.3.7 up to 5.3.7-tuxcare.5, plus listed versions 5.3.7-tuxcare.15.3.7-tuxcare.25.3.7-tuxcare.35.3.7-tuxcare.4	5.3.7-tuxcare.5
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 10 CVEs	5.3.7 up to 5.3.7-tuxcare.5, plus listed versions 5.3.7-tuxcare.15.3.7-tuxcare.25.3.7-tuxcare.35.3.7-tuxcare.4	5.3.7-tuxcare.5
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 10 CVEs	5.3.7 up to 5.3.7-tuxcare.5, plus listed versions 5.3.7-tuxcare.15.3.7-tuxcare.25.3.7-tuxcare.35.3.7-tuxcare.4	5.3.7-tuxcare.5
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 10 CVEs	5.3.7 up to 5.3.7-tuxcare.5, plus listed versions 5.3.7-tuxcare.15.3.7-tuxcare.25.3.7-tuxcare.35.3.7-tuxcare.4	5.3.7-tuxcare.5
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 10 CVEs	5.3.7 up to 5.3.7-tuxcare.5, plus listed versions 5.3.7-tuxcare.15.3.7-tuxcare.25.3.7-tuxcare.35.3.7-tuxcare.4	5.3.7-tuxcare.5
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 7 CVEs	5.3.29 up to 5.3.29-tuxcare.6, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.25.3.29-tuxcare.35.3.29-tuxcare.45.3.29-tuxcare.5	5.3.29-tuxcare.6
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 7 CVEs	5.3.29 up to 5.3.29-tuxcare.6, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.25.3.29-tuxcare.35.3.29-tuxcare.45.3.29-tuxcare.5	5.3.29-tuxcare.6
`org.springframework:spring-jms` TuxCare:Maven From an advisory covering 7 CVEs	5.3.29 up to 5.3.29-tuxcare.6, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.25.3.29-tuxcare.35.3.29-tuxcare.45.3.29-tuxcare.5	5.3.29-tuxcare.6
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 7 CVEs	5.3.29 up to 5.3.29-tuxcare.6, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.25.3.29-tuxcare.35.3.29-tuxcare.45.3.29-tuxcare.5	5.3.29-tuxcare.6
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 7 CVEs	5.3.29 up to 5.3.29-tuxcare.6, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.25.3.29-tuxcare.35.3.29-tuxcare.45.3.29-tuxcare.5	5.3.29-tuxcare.6
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 5 CVEs	5.3.31 up to 5.3.31-tuxcare.11, plus listed versions 5.3.31-tuxcare.15.3.31-tuxcare.105.3.31-tuxcare.25.3.31-tuxcare.35.3.31-tuxcare.4 Show 6 moreShow less 5.3.31-tuxcare.55.3.31-tuxcare.65.3.31-tuxcare.75.3.31-tuxcare.85.3.31-tuxcare.95.3.31.tuxcare	5.3.31-tuxcare.11
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 5 CVEs	5.3.31 up to 5.3.31-tuxcare.11, plus listed versions 5.3.31-tuxcare.15.3.31-tuxcare.105.3.31-tuxcare.25.3.31-tuxcare.35.3.31-tuxcare.4 Show 6 moreShow less 5.3.31-tuxcare.55.3.31-tuxcare.65.3.31-tuxcare.75.3.31-tuxcare.85.3.31-tuxcare.95.3.31.tuxcare	5.3.31-tuxcare.11
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 5 CVEs	5.3.31 up to 5.3.31-tuxcare.11, plus listed versions 5.3.31-tuxcare.15.3.31-tuxcare.105.3.31-tuxcare.25.3.31-tuxcare.35.3.31-tuxcare.4 Show 6 moreShow less 5.3.31-tuxcare.55.3.31-tuxcare.65.3.31-tuxcare.75.3.31-tuxcare.85.3.31-tuxcare.95.3.31.tuxcare	5.3.31-tuxcare.11
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 21 CVEs	5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.4, plus listed versions 5.2.0.RELEASE-tuxcare.15.2.0.RELEASE-tuxcare.25.2.0.RELEASE-tuxcare.3	5.2.0.RELEASE-tuxcare.4
`org.springframework:spring-jms` TuxCare:Maven From an advisory covering 21 CVEs	5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.4, plus listed versions 5.2.0.RELEASE-tuxcare.15.2.0.RELEASE-tuxcare.25.2.0.RELEASE-tuxcare.3	5.2.0.RELEASE-tuxcare.4
`org.springframework:spring-messaging` TuxCare:Maven From an advisory covering 21 CVEs	5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.4, plus listed versions 5.2.0.RELEASE-tuxcare.15.2.0.RELEASE-tuxcare.25.2.0.RELEASE-tuxcare.3	5.2.0.RELEASE-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 21 CVEs	5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.4, plus listed versions 5.2.0.RELEASE-tuxcare.15.2.0.RELEASE-tuxcare.25.2.0.RELEASE-tuxcare.3	5.2.0.RELEASE-tuxcare.4
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 21 CVEs	5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.4, plus listed versions 5.2.0.RELEASE-tuxcare.15.2.0.RELEASE-tuxcare.25.2.0.RELEASE-tuxcare.3	5.2.0.RELEASE-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 21 CVEs	5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.4, plus listed versions 5.2.0.RELEASE-tuxcare.15.2.0.RELEASE-tuxcare.25.2.0.RELEASE-tuxcare.3	5.2.0.RELEASE-tuxcare.4
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 21 CVEs	5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.4, plus listed versions 5.2.0.RELEASE-tuxcare.15.2.0.RELEASE-tuxcare.25.2.0.RELEASE-tuxcare.3	5.2.0.RELEASE-tuxcare.4
`org.springframework:spring` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-context-support` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 18 CVEs	5.3.6 up to 5.3.6-tuxcare.1	5.3.6-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 32 CVEs	5.3.33 up to 5.3.33-tuxcare.1	5.3.33-tuxcare.1
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 32 CVEs	5.3.33 up to 5.3.33-tuxcare.1	5.3.33-tuxcare.1
`org.springframework:spring-context-support` TuxCare:Maven From an advisory covering 32 CVEs	5.3.33 up to 5.3.33-tuxcare.1	5.3.33-tuxcare.1
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 32 CVEs	5.3.33 up to 5.3.33-tuxcare.1	5.3.33-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 32 CVEs	5.3.33 up to 5.3.33-tuxcare.1	5.3.33-tuxcare.1
`org.springframework:spring-jms` TuxCare:Maven From an advisory covering 32 CVEs	5.3.33 up to 5.3.33-tuxcare.1	5.3.33-tuxcare.1
`org.springframework:spring-messaging` TuxCare:Maven From an advisory covering 32 CVEs	5.3.33 up to 5.3.33-tuxcare.1	5.3.33-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 32 CVEs	5.3.33 up to 5.3.33-tuxcare.1	5.3.33-tuxcare.1
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 32 CVEs	5.3.33 up to 5.3.33-tuxcare.1	5.3.33-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 32 CVEs	5.3.33 up to 5.3.33-tuxcare.1	5.3.33-tuxcare.1
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 32 CVEs	5.3.33 up to 5.3.33-tuxcare.1	5.3.33-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 27 CVEs	5.2.17.RELEASE up to 5.2.17.RELEASE-tuxcare.1	5.2.17.RELEASE-tuxcare.1
`org.springframework:spring-context-support` TuxCare:Maven From an advisory covering 27 CVEs	5.2.17.RELEASE up to 5.2.17.RELEASE-tuxcare.1	5.2.17.RELEASE-tuxcare.1
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 27 CVEs	5.2.17.RELEASE up to 5.2.17.RELEASE-tuxcare.1	5.2.17.RELEASE-tuxcare.1
`org.springframework:spring-jms` TuxCare:Maven From an advisory covering 27 CVEs	5.2.17.RELEASE up to 5.2.17.RELEASE-tuxcare.1	5.2.17.RELEASE-tuxcare.1
`org.springframework:spring-messaging` TuxCare:Maven From an advisory covering 27 CVEs	5.2.17.RELEASE up to 5.2.17.RELEASE-tuxcare.1	5.2.17.RELEASE-tuxcare.1
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 27 CVEs	5.2.17.RELEASE up to 5.2.17.RELEASE-tuxcare.1	5.2.17.RELEASE-tuxcare.1
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 27 CVEs	5.2.17.RELEASE up to 5.2.17.RELEASE-tuxcare.1	5.2.17.RELEASE-tuxcare.1
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 27 CVEs	5.2.17.RELEASE up to 5.2.17.RELEASE-tuxcare.1	5.2.17.RELEASE-tuxcare.1
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 17 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.3, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.2	5.2.7.RELEASE-tuxcare.3
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 17 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.3, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.2	5.2.7.RELEASE-tuxcare.3
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 17 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.3, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.2	5.2.7.RELEASE-tuxcare.3
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 17 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.3, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.2	5.2.7.RELEASE-tuxcare.3
`org.springframework:spring-framework-bom` TuxCare:Maven From an advisory covering 17 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.3, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.2	5.2.7.RELEASE-tuxcare.3
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 17 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.3, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.2	5.2.7.RELEASE-tuxcare.3
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 17 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.3, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.2	5.2.7.RELEASE-tuxcare.3
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 17 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.3, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.2	5.2.7.RELEASE-tuxcare.3
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 17 CVEs	5.2.7.RELEASE up to 5.2.7.RELEASE-tuxcare.3, plus listed versions 5.2.7.RELEASE-tuxcare.15.2.7.RELEASE-tuxcare.2	5.2.7.RELEASE-tuxcare.3
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 16 CVEs	5.2.9.RELEASE up to 5.2.9.RELEASE-tuxcare.2, plus listed versions 5.2.9.RELEASE-tuxcare.1	5.2.9.RELEASE-tuxcare.2
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 16 CVEs	5.2.9.RELEASE up to 5.2.9.RELEASE-tuxcare.2, plus listed versions 5.2.9.RELEASE-tuxcare.1	5.2.9.RELEASE-tuxcare.2
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 16 CVEs	5.2.9.RELEASE up to 5.2.9.RELEASE-tuxcare.2, plus listed versions 5.2.9.RELEASE-tuxcare.1	5.2.9.RELEASE-tuxcare.2
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 16 CVEs	5.2.9.RELEASE up to 5.2.9.RELEASE-tuxcare.2, plus listed versions 5.2.9.RELEASE-tuxcare.1	5.2.9.RELEASE-tuxcare.2
`org.springframework:spring-framework-bom` TuxCare:Maven From an advisory covering 16 CVEs	5.2.9.RELEASE up to 5.2.9.RELEASE-tuxcare.2, plus listed versions 5.2.9.RELEASE-tuxcare.1	5.2.9.RELEASE-tuxcare.2
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 16 CVEs	5.2.9.RELEASE up to 5.2.9.RELEASE-tuxcare.2, plus listed versions 5.2.9.RELEASE-tuxcare.1	5.2.9.RELEASE-tuxcare.2
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 16 CVEs	5.2.9.RELEASE up to 5.2.9.RELEASE-tuxcare.2, plus listed versions 5.2.9.RELEASE-tuxcare.1	5.2.9.RELEASE-tuxcare.2
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 16 CVEs	5.2.9.RELEASE up to 5.2.9.RELEASE-tuxcare.2, plus listed versions 5.2.9.RELEASE-tuxcare.1	5.2.9.RELEASE-tuxcare.2
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 16 CVEs	5.2.9.RELEASE up to 5.2.9.RELEASE-tuxcare.2, plus listed versions 5.2.9.RELEASE-tuxcare.1	5.2.9.RELEASE-tuxcare.2
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 13 CVEs	5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2	5.2.10.RELEASE-tuxcare.3
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 13 CVEs	5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2	5.2.10.RELEASE-tuxcare.3
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 13 CVEs	5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2	5.2.10.RELEASE-tuxcare.3
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 13 CVEs	5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2	5.2.10.RELEASE-tuxcare.3
`org.springframework:spring-framework-bom` TuxCare:Maven From an advisory covering 13 CVEs	5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2	5.2.10.RELEASE-tuxcare.3
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 13 CVEs	5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2	5.2.10.RELEASE-tuxcare.3
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 13 CVEs	5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2	5.2.10.RELEASE-tuxcare.3
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 13 CVEs	5.2.10.RELEASE up to 5.2.10.RELEASE-tuxcare.3, plus listed versions 5.2.10.RELEASE-tuxcare.15.2.10.RELEASE-tuxcare.2	5.2.10.RELEASE-tuxcare.3
`org.springframework:spring` TuxCare:Maven From an advisory covering 10 CVEs	5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3	5.3.23-tuxcare.4
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 10 CVEs	5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3	5.3.23-tuxcare.4
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 10 CVEs	5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3	5.3.23-tuxcare.4
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 10 CVEs	5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3	5.3.23-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 10 CVEs	5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3	5.3.23-tuxcare.4
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 10 CVEs	5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3	5.3.23-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 10 CVEs	5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3	5.3.23-tuxcare.4
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 7 CVEs	5.3.13 up to 5.3.13-tuxcare.5, plus listed versions 5.3.13-tuxcare.15.3.13-tuxcare.25.3.13-tuxcare.35.3.13-tuxcare.4	5.3.13-tuxcare.5
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 7 CVEs	5.3.13 up to 5.3.13-tuxcare.5, plus listed versions 5.3.13-tuxcare.15.3.13-tuxcare.25.3.13-tuxcare.35.3.13-tuxcare.4	5.3.13-tuxcare.5
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 7 CVEs	5.3.13 up to 5.3.13-tuxcare.5, plus listed versions 5.3.13-tuxcare.15.3.13-tuxcare.25.3.13-tuxcare.35.3.13-tuxcare.4	5.3.13-tuxcare.5
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 7 CVEs	5.3.13 up to 5.3.13-tuxcare.5, plus listed versions 5.3.13-tuxcare.15.3.13-tuxcare.25.3.13-tuxcare.35.3.13-tuxcare.4	5.3.13-tuxcare.5
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 7 CVEs	5.3.13 up to 5.3.13-tuxcare.5, plus listed versions 5.3.13-tuxcare.15.3.13-tuxcare.25.3.13-tuxcare.35.3.13-tuxcare.4	5.3.13-tuxcare.5
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 7 CVEs	5.3.13 up to 5.3.13-tuxcare.5, plus listed versions 5.3.13-tuxcare.15.3.13-tuxcare.25.3.13-tuxcare.35.3.13-tuxcare.4	5.3.13-tuxcare.5
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 3 CVEs	5.2.25.RELEASE up to 5.2.25.RELEASE-tuxcare.4, plus listed versions 5.2.25.RELEASE-tuxcare.15.2.25.RELEASE-tuxcare.25.2.25.RELEASE-tuxcare.3	5.2.25.RELEASE-tuxcare.4
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 3 CVEs	5.2.25.RELEASE up to 5.2.25.RELEASE-tuxcare.4, plus listed versions 5.2.25.RELEASE-tuxcare.15.2.25.RELEASE-tuxcare.25.2.25.RELEASE-tuxcare.3	5.2.25.RELEASE-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 3 CVEs	5.2.25.RELEASE up to 5.2.25.RELEASE-tuxcare.4, plus listed versions 5.2.25.RELEASE-tuxcare.15.2.25.RELEASE-tuxcare.25.2.25.RELEASE-tuxcare.3	5.2.25.RELEASE-tuxcare.4
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 3 CVEs	5.2.25.RELEASE up to 5.2.25.RELEASE-tuxcare.4, plus listed versions 5.2.25.RELEASE-tuxcare.15.2.25.RELEASE-tuxcare.25.2.25.RELEASE-tuxcare.3	5.2.25.RELEASE-tuxcare.4
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 8 CVEs	5.3.20 up to 5.3.20-tuxcare.4, plus listed versions 5.3.20-tuxcare.15.3.20-tuxcare.25.3.20-tuxcare.3	5.3.20-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 8 CVEs	5.3.20 up to 5.3.20-tuxcare.4, plus listed versions 5.3.20-tuxcare.15.3.20-tuxcare.25.3.20-tuxcare.3	5.3.20-tuxcare.4
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 8 CVEs	5.3.20 up to 5.3.20-tuxcare.4, plus listed versions 5.3.20-tuxcare.15.3.20-tuxcare.25.3.20-tuxcare.3	5.3.20-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 8 CVEs	5.3.20 up to 5.3.20-tuxcare.4, plus listed versions 5.3.20-tuxcare.15.3.20-tuxcare.25.3.20-tuxcare.3	5.3.20-tuxcare.4
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 8 CVEs	5.3.20 up to 5.3.20-tuxcare.4, plus listed versions 5.3.20-tuxcare.15.3.20-tuxcare.25.3.20-tuxcare.3	5.3.20-tuxcare.4
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 18 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.3, plus listed versions 5.2.8.RELEASE-tuxcare.15.2.8.RELEASE-tuxcare.2	5.2.8.RELEASE-tuxcare.3
`org.springframework:spring-context` TuxCare:Maven From an advisory covering 18 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.3, plus listed versions 5.2.8.RELEASE-tuxcare.15.2.8.RELEASE-tuxcare.2	5.2.8.RELEASE-tuxcare.3
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 18 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.3, plus listed versions 5.2.8.RELEASE-tuxcare.15.2.8.RELEASE-tuxcare.2	5.2.8.RELEASE-tuxcare.3
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 18 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.3, plus listed versions 5.2.8.RELEASE-tuxcare.15.2.8.RELEASE-tuxcare.2	5.2.8.RELEASE-tuxcare.3
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 18 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.3, plus listed versions 5.2.8.RELEASE-tuxcare.15.2.8.RELEASE-tuxcare.2	5.2.8.RELEASE-tuxcare.3
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 18 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.3, plus listed versions 5.2.8.RELEASE-tuxcare.15.2.8.RELEASE-tuxcare.2	5.2.8.RELEASE-tuxcare.3
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 18 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.3, plus listed versions 5.2.8.RELEASE-tuxcare.15.2.8.RELEASE-tuxcare.2	5.2.8.RELEASE-tuxcare.3
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 18 CVEs	5.2.8.RELEASE up to 5.2.8.RELEASE-tuxcare.3, plus listed versions 5.2.8.RELEASE-tuxcare.15.2.8.RELEASE-tuxcare.2	5.2.8.RELEASE-tuxcare.3
`org.springframework:spring` TuxCare:Maven From an advisory covering 8 CVEs	5.3.3 up to 5.3.3-tuxcare.4, plus listed versions 5.3.3-tuxcare.15.3.3-tuxcare.25.3.3-tuxcare.3	5.3.3-tuxcare.4
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 8 CVEs	5.3.3 up to 5.3.3-tuxcare.4, plus listed versions 5.3.3-tuxcare.15.3.3-tuxcare.25.3.3-tuxcare.3	5.3.3-tuxcare.4
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 8 CVEs	5.3.3 up to 5.3.3-tuxcare.4, plus listed versions 5.3.3-tuxcare.15.3.3-tuxcare.25.3.3-tuxcare.3	5.3.3-tuxcare.4
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 8 CVEs	5.3.3 up to 5.3.3-tuxcare.4, plus listed versions 5.3.3-tuxcare.15.3.3-tuxcare.25.3.3-tuxcare.3	5.3.3-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 8 CVEs	5.3.3 up to 5.3.3-tuxcare.4, plus listed versions 5.3.3-tuxcare.15.3.3-tuxcare.25.3.3-tuxcare.3	5.3.3-tuxcare.4
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 8 CVEs	5.3.3 up to 5.3.3-tuxcare.4, plus listed versions 5.3.3-tuxcare.15.3.3-tuxcare.25.3.3-tuxcare.3	5.3.3-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 8 CVEs	5.3.3 up to 5.3.3-tuxcare.4, plus listed versions 5.3.3-tuxcare.15.3.3-tuxcare.25.3.3-tuxcare.3	5.3.3-tuxcare.4
`org.springframework:spring` TuxCare:Maven From an advisory covering 14 CVEs	5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2	5.3.5-tuxcare.3
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 14 CVEs	5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2	5.3.5-tuxcare.3
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 14 CVEs	5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2	5.3.5-tuxcare.3
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 14 CVEs	5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2	5.3.5-tuxcare.3
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 14 CVEs	5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2	5.3.5-tuxcare.3
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 14 CVEs	5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2	5.3.5-tuxcare.3
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 14 CVEs	5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2	5.3.5-tuxcare.3
`org.springframework:spring-websocket` TuxCare:Maven From an advisory covering 14 CVEs	5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2	5.3.5-tuxcare.3
`org.springframework:spring-beans` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-core` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-expression` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-framework-bom` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-web` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-webflux` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`org.springframework:spring-webmvc` TuxCare:Maven From an advisory covering 13 CVEs	5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.4, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.3	5.2.11.RELEASE-tuxcare.4
`libspring-java` Debian:12	All versions, plus listed versions 4.3.30-24.3.30-34.3.30-4	None known
`libspring-java` Debian:13	All versions, plus listed versions 4.3.30-34.3.30-4	None known
`libspring-java` Debian:14	All versions, plus listed versions 4.3.30-34.3.30-4	None known
`org.springframework:spring-webflux` Maven	through 5.3.39, plus listed versions 5.0.0.RELEASE5.0.1.RELEASE5.0.10.RELEASE5.0.11.RELEASE5.0.12.RELEASE Show 45 moreShow less 5.0.13.RELEASE5.0.14.RELEASE5.0.15.RELEASE5.0.16.RELEASE5.0.17.RELEASE5.0.18.RELEASE5.0.19.RELEASE5.0.2.RELEASE5.0.20.RELEASE5.0.3.RELEASE5.0.4.RELEASE5.0.5.RELEASE5.0.6.RELEASE5.0.7.RELEASE5.0.8.RELEASE5.0.9.RELEASE5.1.0.RELEASE5.1.1.RELEASE5.1.10.RELEASE5.1.11.RELEASE5.1.12.RELEASE5.1.13.RELEASE5.1.14.RELEASE5.1.15.RELEASE5.1.16.RELEASE5.1.17.RELEASE5.1.18.RELEASE5.1.19.RELEASE5.1.2.RELEASE5.1.20.RELEASE5.1.3.RELEASE5.1.4.RELEASE5.1.5.RELEASE5.1.6.RELEASE5.1.7.RELEASE5.1.8.RELEASE5.1.9.RELEASE5.2.0.RELEASE5.2.1.RELEASE5.2.10.RELEASE5.2.11.RELEASE5.2.12.RELEASE5.2.13.RELEASE5.2.14.RELEASE5.2.15.RELEASE	None known
`org.springframework:spring-webflux` Red Hat Lightwell:Maven From an advisory covering 16 CVEs	before 5.3.18.rhlw-00010, plus listed versions 5.0.0.RELEASE5.0.1.RELEASE5.0.10.RELEASE5.0.11.RELEASE5.0.12.RELEASE Show 45 moreShow less 5.0.13.RELEASE5.0.14.RELEASE5.0.15.RELEASE5.0.16.RELEASE5.0.17.RELEASE5.0.18.RELEASE5.0.19.RELEASE5.0.2.RELEASE5.0.20.RELEASE5.0.3.RELEASE5.0.4.RELEASE5.0.5.RELEASE5.0.6.RELEASE5.0.7.RELEASE5.0.8.RELEASE5.0.9.RELEASE5.1.0.RELEASE5.1.1.RELEASE5.1.10.RELEASE5.1.11.RELEASE5.1.12.RELEASE5.1.13.RELEASE5.1.14.RELEASE5.1.15.RELEASE5.1.16.RELEASE5.1.17.RELEASE5.1.18.RELEASE5.1.19.RELEASE5.1.2.RELEASE5.1.20.RELEASE5.1.3.RELEASE5.1.4.RELEASE5.1.5.RELEASE5.1.6.RELEASE5.1.7.RELEASE5.1.8.RELEASE5.1.9.RELEASE5.2.0.RELEASE5.2.1.RELEASE5.2.10.RELEASE5.2.11.RELEASE5.2.12.RELEASE5.2.13.RELEASE5.2.14.RELEASE5.2.15.RELEASE	5.3.18.rhlw-00010
`libspring-java` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 3.0.6.RELEASE-73.0.6.RELEASE-83.0.6.RELEASE-93.0.6.RELEASE-103.0.6.RELEASE-11 Show 4 moreShow less 3.0.6.RELEASE-123.0.6.RELEASE-133.0.6.RELEASE-13ubuntu0.1~esm13.0.6.RELEASE-13ubuntu0.1~esm2	None known
`libspring-java` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.2.13-33.2.13-43.2.13-53.2.13-5ubuntu0.1~esm1	None known
`libspring-java` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 4.3.11-14.3.12-14.3.13-24.3.14-14.3.22-1~18.044.3.22-1~18.04.1~esm1	None known
`libspring-java` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 4.3.22-44.3.22-4ubuntu0.1~esm1	None known
`libspring-java` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 4.3.30-14.3.30-1ubuntu0.1~esm1	None known
`libspring-java` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 4.3.30-24.3.30-2ubuntu0.24.04.1~esm1	None known
`libspring-java` Ubuntu:25.10	All versions, plus listed versions 4.3.30-2ubuntu14.3.30-3ubuntu1	None known
`libspring-java` Ubuntu:26.10	All versions, plus listed versions 4.3.30-3ubuntu1	None known
`libspring-java` Ubuntu:26.04:LTS	All versions, plus listed versions 4.3.30-3ubuntu1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, aliases
Nov 6, 2026	affected, aliases	OSV
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 2, 2026	affected, affected_more, aliases	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41847 is a medium vulnerability (CVSS 4.8) in Spring Framework, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 5th percentile. No source names a fixed version.

References

Show 20 moreShow less

This page doesn't list everything

Left out here: 94 versions. The JSON record has them.