{"id":"CVE-2026-41840","aliases":["CLSA-2026-1785952964","CLSA-2026-1785969383","CLSA-2026-1787728788","CLSA-2026-1788253139","CLSA-2026-1789218209","CLSA-2026-1789722420","CLSA-2026-1790068772","CLSA-2026-1790068919","CLSA-2026-1790082496","CLSA-2026-1790082526","CLSA-2026-1790694250","CLSA-2026-1791280908","CLSA-2026-1791281988","CLSA-2026-1791390736","CLSA-2026-1792584150","CLSA-2026-1792585518","CLSA-2026-1792585696","CLSA-2026-1792587283","CLSA-2026-1792588215","CLSA-2026-1792590675","CLSA-2026-1792591234","CLSA-2026-1792599701","CLSA-2026-1792600420","CLSA-2026-1792600478","CLSA-2026-1792600502","CLSA-2026-1792600685","CLSA-2026-1792601217","CLSA-2026-1794179109","CLSA-2026-1794180285","DEBIAN-CVE-2026-41840","EUVD-2026-35327","GHSA-83f7-v6px-pp3h","GHSA-cx7f-g6mp-7hqm","GHSA-g5vr-rgqm-vf78","RHLW-2026-8ef16ddaa2e22182","UBUNTU-CVE-2026-41840"],"status":"published","title":"Spring Framework Denial of Service via Multipart Requests in WebFlux","description":"Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.\nAffected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00267,"percentile":0.18977,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-401"],"published":"2026-06-09T03:50:15Z","modified":"2026-11-10T02:32:10Z","fixes":[{"ecosystem":"Maven","package":"org.springframework:spring-webflux","fixed_in":["7.0.8","6.2.19"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","fixed_in":["6.1.21-tuxcare.13","6.1.20-tuxcare.11","6.1.19-tuxcare.5","6.2.5-tuxcare.5","6.2.3-tuxcare.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.7"},{"fixed":"7.0.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"last_affected":"6.2.18"},{"fixed":"6.2.19"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"last_affected":"6.1.21"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.3.39"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.3"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.3"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.3"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.3"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.3"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.39"},{"fixed":"5.3.39-tuxcare.18"}]}],"versions":["5.3.39","5.3.39-tuxcare.10","5.3.39-tuxcare.11","5.3.39-tuxcare.12","5.3.39-tuxcare.13","5.3.39-tuxcare.14","5.3.39-tuxcare.15","5.3.39-tuxcare.16","5.3.39-tuxcare.17","5.3.39-tuxcare.7","5.3.39-tuxcare.8","5.3.39-tuxcare.9","5.3.39.tuxcare.1","5.3.39.tuxcare.3","5.3.39.tuxcare.4","5.3.39.tuxcare.5","5.3.39.tuxcare.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.39"},{"fixed":"5.3.39-tuxcare.18"}]}],"versions":["5.3.39","5.3.39-tuxcare.10","5.3.39-tuxcare.11","5.3.39-tuxcare.12","5.3.39-tuxcare.13","5.3.39-tuxcare.14","5.3.39-tuxcare.15","5.3.39-tuxcare.16","5.3.39-tuxcare.17","5.3.39-tuxcare.7","5.3.39-tuxcare.8","5.3.39-tuxcare.9","5.3.39.tuxcare.1","5.3.39.tuxcare.3","5.3.39.tuxcare.4","5.3.39.tuxcare.5","5.3.39.tuxcare.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.1"}]}],"versions":["6.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.1"}]}],"versions":["6.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.1"}]}],"versions":["6.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.1"}]}],"versions":["6.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.1"}]}],"versions":["6.2.13"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.21"},{"fixed":"6.1.21-tuxcare.13"}]}],"versions":["6.1.21","6.1.21-tuxcare.1","6.1.21-tuxcare.10","6.1.21-tuxcare.11","6.1.21-tuxcare.12","6.1.21-tuxcare.2","6.1.21-tuxcare.3","6.1.21-tuxcare.4","6.1.21-tuxcare.5","6.1.21-tuxcare.6","6.1.21-tuxcare.7","6.1.21-tuxcare.8","6.1.21-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.18"},{"fixed":"6.1.18-tuxcare.1"}]}],"versions":["6.1.18"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.18"},{"fixed":"6.1.18-tuxcare.1"}]}],"versions":["6.1.18"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.18"},{"fixed":"6.1.18-tuxcare.1"}]}],"versions":["6.1.18"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.18"},{"fixed":"6.1.18-tuxcare.1"}]}],"versions":["6.1.18"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.18"},{"fixed":"6.1.18-tuxcare.1"}]}],"versions":["6.1.18"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.18"},{"fixed":"6.1.18-tuxcare.1"}]}],"versions":["6.1.18"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.18"},{"fixed":"6.1.18-tuxcare.1"}]}],"versions":["6.1.18"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.18"},{"fixed":"6.1.18-tuxcare.1"}]}],"versions":["6.1.18"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.18"},{"fixed":"6.1.18-tuxcare.1"}]}],"versions":["6.1.18"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.18"},{"fixed":"6.1.18-tuxcare.1"}]}],"versions":["6.1.18"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.18"},{"fixed":"6.1.18-tuxcare.1"}]}],"versions":["6.1.18"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.20"},{"fixed":"6.1.20-tuxcare.11"}]}],"versions":["6.1.20","6.1.20-tuxcare.1","6.1.20-tuxcare.10","6.1.20-tuxcare.2","6.1.20-tuxcare.3","6.1.20-tuxcare.4","6.1.20-tuxcare.5","6.1.20-tuxcare.6","6.1.20-tuxcare.7","6.1.20-tuxcare.8","6.1.20-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.19"},{"fixed":"6.1.19-tuxcare.5"}]}],"versions":["6.1.19","6.1.19-tuxcare.1","6.1.19-tuxcare.2","6.1.19-tuxcare.3","6.1.19-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.2"}]}],"versions":["5.3.33","5.3.33-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.2"}]}],"versions":["5.3.33","5.3.33-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.2"}]}],"versions":["5.3.33","5.3.33-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.23"},{"fixed":"6.0.23-tuxcare.11"}]}],"versions":["6.0.23","6.0.23-tuxcare.1","6.0.23-tuxcare.10","6.0.23-tuxcare.2","6.0.23-tuxcare.3","6.0.23-tuxcare.4","6.0.23-tuxcare.5","6.0.23-tuxcare.6","6.0.23-tuxcare.7","6.0.23-tuxcare.8","6.0.23-tuxcare.9"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.23"},{"fixed":"6.0.23-tuxcare.11"}]}],"versions":["6.0.23","6.0.23-tuxcare.1","6.0.23-tuxcare.10","6.0.23-tuxcare.2","6.0.23-tuxcare.3","6.0.23-tuxcare.4","6.0.23-tuxcare.5","6.0.23-tuxcare.6","6.0.23-tuxcare.7","6.0.23-tuxcare.8","6.0.23-tuxcare.9"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.23"},{"fixed":"6.0.23-tuxcare.11"}]}],"versions":["6.0.23","6.0.23-tuxcare.1","6.0.23-tuxcare.10","6.0.23-tuxcare.2","6.0.23-tuxcare.3","6.0.23-tuxcare.4","6.0.23-tuxcare.5","6.0.23-tuxcare.6","6.0.23-tuxcare.7","6.0.23-tuxcare.8","6.0.23-tuxcare.9"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.23"},{"fixed":"6.0.23-tuxcare.11"}]}],"versions":["6.0.23","6.0.23-tuxcare.1","6.0.23-tuxcare.10","6.0.23-tuxcare.2","6.0.23-tuxcare.3","6.0.23-tuxcare.4","6.0.23-tuxcare.5","6.0.23-tuxcare.6","6.0.23-tuxcare.7","6.0.23-tuxcare.8","6.0.23-tuxcare.9"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.23"},{"fixed":"6.0.23-tuxcare.11"}]}],"versions":["6.0.23","6.0.23-tuxcare.1","6.0.23-tuxcare.10","6.0.23-tuxcare.2","6.0.23-tuxcare.3","6.0.23-tuxcare.4","6.0.23-tuxcare.5","6.0.23-tuxcare.6","6.0.23-tuxcare.7","6.0.23-tuxcare.8","6.0.23-tuxcare.9"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.23"},{"fixed":"6.0.23-tuxcare.11"}]}],"versions":["6.0.23","6.0.23-tuxcare.1","6.0.23-tuxcare.10","6.0.23-tuxcare.2","6.0.23-tuxcare.3","6.0.23-tuxcare.4","6.0.23-tuxcare.5","6.0.23-tuxcare.6","6.0.23-tuxcare.7","6.0.23-tuxcare.8","6.0.23-tuxcare.9"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.16"},{"fixed":"6.1.16-tuxcare.7"}]}],"versions":["6.1.16","6.1.16-tuxcare.1","6.1.16-tuxcare.2","6.1.16-tuxcare.3","6.1.16-tuxcare.4","6.1.16-tuxcare.5","6.1.16-tuxcare.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.16"},{"fixed":"6.1.16-tuxcare.7"}]}],"versions":["6.1.16","6.1.16-tuxcare.1","6.1.16-tuxcare.2","6.1.16-tuxcare.3","6.1.16-tuxcare.4","6.1.16-tuxcare.5","6.1.16-tuxcare.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.16"},{"fixed":"6.1.16-tuxcare.7"}]}],"versions":["6.1.16","6.1.16-tuxcare.1","6.1.16-tuxcare.2","6.1.16-tuxcare.3","6.1.16-tuxcare.4","6.1.16-tuxcare.5","6.1.16-tuxcare.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.16"},{"fixed":"6.1.16-tuxcare.7"}]}],"versions":["6.1.16","6.1.16-tuxcare.1","6.1.16-tuxcare.2","6.1.16-tuxcare.3","6.1.16-tuxcare.4","6.1.16-tuxcare.5","6.1.16-tuxcare.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.16"},{"fixed":"6.0.16-tuxcare.10"}]}],"versions":["6.0.16","6.0.16-tuxcare.1","6.0.16-tuxcare.2","6.0.16-tuxcare.3","6.0.16-tuxcare.4","6.0.16-tuxcare.5","6.0.16-tuxcare.6","6.0.16-tuxcare.7","6.0.16-tuxcare.8","6.0.16-tuxcare.9"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.16"},{"fixed":"6.0.16-tuxcare.10"}]}],"versions":["6.0.16","6.0.16-tuxcare.1","6.0.16-tuxcare.2","6.0.16-tuxcare.3","6.0.16-tuxcare.4","6.0.16-tuxcare.5","6.0.16-tuxcare.6","6.0.16-tuxcare.7","6.0.16-tuxcare.8","6.0.16-tuxcare.9"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.16"},{"fixed":"6.0.16-tuxcare.10"}]}],"versions":["6.0.16","6.0.16-tuxcare.1","6.0.16-tuxcare.2","6.0.16-tuxcare.3","6.0.16-tuxcare.4","6.0.16-tuxcare.5","6.0.16-tuxcare.6","6.0.16-tuxcare.7","6.0.16-tuxcare.8","6.0.16-tuxcare.9"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.16"},{"fixed":"6.0.16-tuxcare.10"}]}],"versions":["6.0.16","6.0.16-tuxcare.1","6.0.16-tuxcare.2","6.0.16-tuxcare.3","6.0.16-tuxcare.4","6.0.16-tuxcare.5","6.0.16-tuxcare.6","6.0.16-tuxcare.7","6.0.16-tuxcare.8","6.0.16-tuxcare.9"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.13"},{"fixed":"6.1.13-tuxcare.4"}]}],"versions":["6.1.13","6.1.13-tuxcare.1","6.1.13-tuxcare.2","6.1.13-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.13"},{"fixed":"6.1.13-tuxcare.4"}]}],"versions":["6.1.13","6.1.13-tuxcare.1","6.1.13-tuxcare.2","6.1.13-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.13"},{"fixed":"6.1.13-tuxcare.4"}]}],"versions":["6.1.13","6.1.13-tuxcare.1","6.1.13-tuxcare.2","6.1.13-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.13"},{"fixed":"6.1.13-tuxcare.4"}]}],"versions":["6.1.13","6.1.13-tuxcare.1","6.1.13-tuxcare.2","6.1.13-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.12"},{"fixed":"6.0.12-tuxcare.6"}]}],"versions":["6.0.12","6.0.12-tuxcare.1","6.0.12-tuxcare.2","6.0.12-tuxcare.3","6.0.12-tuxcare.4","6.0.12-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.12"},{"fixed":"6.0.12-tuxcare.6"}]}],"versions":["6.0.12","6.0.12-tuxcare.1","6.0.12-tuxcare.2","6.0.12-tuxcare.3","6.0.12-tuxcare.4","6.0.12-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.12"},{"fixed":"6.0.12-tuxcare.6"}]}],"versions":["6.0.12","6.0.12-tuxcare.1","6.0.12-tuxcare.2","6.0.12-tuxcare.3","6.0.12-tuxcare.4","6.0.12-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.12"},{"fixed":"6.0.12-tuxcare.6"}]}],"versions":["6.0.12","6.0.12-tuxcare.1","6.0.12-tuxcare.2","6.0.12-tuxcare.3","6.0.12-tuxcare.4","6.0.12-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.12"},{"fixed":"6.0.12-tuxcare.6"}]}],"versions":["6.0.12","6.0.12-tuxcare.1","6.0.12-tuxcare.2","6.0.12-tuxcare.3","6.0.12-tuxcare.4","6.0.12-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.12"},{"fixed":"6.0.12-tuxcare.6"}]}],"versions":["6.0.12","6.0.12-tuxcare.1","6.0.12-tuxcare.2","6.0.12-tuxcare.3","6.0.12-tuxcare.4","6.0.12-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.11"},{"fixed":"6.0.11-tuxcare.6"}]}],"versions":["6.0.11","6.0.11-tuxcare.1","6.0.11-tuxcare.2","6.0.11-tuxcare.3","6.0.11-tuxcare.4","6.0.11-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.11"},{"fixed":"6.0.11-tuxcare.6"}]}],"versions":["6.0.11","6.0.11-tuxcare.1","6.0.11-tuxcare.2","6.0.11-tuxcare.3","6.0.11-tuxcare.4","6.0.11-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.11"},{"fixed":"6.0.11-tuxcare.6"}]}],"versions":["6.0.11","6.0.11-tuxcare.1","6.0.11-tuxcare.2","6.0.11-tuxcare.3","6.0.11-tuxcare.4","6.0.11-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.11"},{"fixed":"6.0.11-tuxcare.6"}]}],"versions":["6.0.11","6.0.11-tuxcare.1","6.0.11-tuxcare.2","6.0.11-tuxcare.3","6.0.11-tuxcare.4","6.0.11-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.11"},{"fixed":"6.0.11-tuxcare.6"}]}],"versions":["6.0.11","6.0.11-tuxcare.1","6.0.11-tuxcare.2","6.0.11-tuxcare.3","6.0.11-tuxcare.4","6.0.11-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.11"},{"fixed":"6.0.11-tuxcare.6"}]}],"versions":["6.0.11","6.0.11-tuxcare.1","6.0.11-tuxcare.2","6.0.11-tuxcare.3","6.0.11-tuxcare.4","6.0.11-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.0-tuxcare.5"}]}],"versions":["6.0.0","6.0.0-tuxcare.1","6.0.0-tuxcare.2","6.0.0-tuxcare.3","6.0.0-tuxcare.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.0-tuxcare.5"}]}],"versions":["6.0.0","6.0.0-tuxcare.1","6.0.0-tuxcare.2","6.0.0-tuxcare.3","6.0.0-tuxcare.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.0-tuxcare.5"}]}],"versions":["6.0.0","6.0.0-tuxcare.1","6.0.0-tuxcare.2","6.0.0-tuxcare.3","6.0.0-tuxcare.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.0-tuxcare.5"}]}],"versions":["6.0.0","6.0.0-tuxcare.1","6.0.0-tuxcare.2","6.0.0-tuxcare.3","6.0.0-tuxcare.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.0-tuxcare.5"}]}],"versions":["6.0.0","6.0.0-tuxcare.1","6.0.0-tuxcare.2","6.0.0-tuxcare.3","6.0.0-tuxcare.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.0-tuxcare.5"}]}],"versions":["6.0.0","6.0.0-tuxcare.1","6.0.0-tuxcare.2","6.0.0-tuxcare.3","6.0.0-tuxcare.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.14"},{"fixed":"6.0.14-tuxcare.2"}]}],"versions":["6.0.14","6.0.14-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.14"},{"fixed":"6.0.14-tuxcare.2"}]}],"versions":["6.0.14","6.0.14-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.14"},{"fixed":"6.0.14-tuxcare.2"}]}],"versions":["6.0.14","6.0.14-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.14"},{"fixed":"6.0.14-tuxcare.2"}]}],"versions":["6.0.14","6.0.14-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.14"},{"fixed":"6.0.14-tuxcare.2"}]}],"versions":["6.0.14","6.0.14-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.14"},{"fixed":"6.0.14-tuxcare.2"}]}],"versions":["6.0.14","6.0.14-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.13"},{"fixed":"6.0.13-tuxcare.6"}]}],"versions":["6.0.13","6.0.13-tuxcare.1","6.0.13-tuxcare.2","6.0.13-tuxcare.3","6.0.13-tuxcare.4","6.0.13-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.13"},{"fixed":"6.0.13-tuxcare.6"}]}],"versions":["6.0.13","6.0.13-tuxcare.1","6.0.13-tuxcare.2","6.0.13-tuxcare.3","6.0.13-tuxcare.4","6.0.13-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.13"},{"fixed":"6.0.13-tuxcare.6"}]}],"versions":["6.0.13","6.0.13-tuxcare.1","6.0.13-tuxcare.2","6.0.13-tuxcare.3","6.0.13-tuxcare.4","6.0.13-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.13"},{"fixed":"6.0.13-tuxcare.6"}]}],"versions":["6.0.13","6.0.13-tuxcare.1","6.0.13-tuxcare.2","6.0.13-tuxcare.3","6.0.13-tuxcare.4","6.0.13-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.13"},{"fixed":"6.0.13-tuxcare.6"}]}],"versions":["6.0.13","6.0.13-tuxcare.1","6.0.13-tuxcare.2","6.0.13-tuxcare.3","6.0.13-tuxcare.4","6.0.13-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.13"},{"fixed":"6.0.13-tuxcare.6"}]}],"versions":["6.0.13","6.0.13-tuxcare.1","6.0.13-tuxcare.2","6.0.13-tuxcare.3","6.0.13-tuxcare.4","6.0.13-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.32"},{"fixed":"5.3.32-tuxcare.2"}]}],"versions":["5.3.32","5.3.32-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.32"},{"fixed":"5.3.32-tuxcare.2"}]}],"versions":["5.3.32","5.3.32-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.32"},{"fixed":"5.3.32-tuxcare.2"}]}],"versions":["5.3.32","5.3.32-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.32"},{"fixed":"5.3.32-tuxcare.2"}]}],"versions":["5.3.32","5.3.32-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.32"},{"fixed":"5.3.32-tuxcare.2"}]}],"versions":["5.3.32","5.3.32-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.32"},{"fixed":"5.3.32-tuxcare.2"}]}],"versions":["5.3.32","5.3.32-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.15"},{"fixed":"6.0.15-tuxcare.5"}]}],"versions":["6.0.15","6.0.15-tuxcare.1","6.0.15-tuxcare.2","6.0.15-tuxcare.3","6.0.15-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.15"},{"fixed":"6.0.15-tuxcare.5"}]}],"versions":["6.0.15","6.0.15-tuxcare.1","6.0.15-tuxcare.2","6.0.15-tuxcare.3","6.0.15-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.15"},{"fixed":"6.0.15-tuxcare.5"}]}],"versions":["6.0.15","6.0.15-tuxcare.1","6.0.15-tuxcare.2","6.0.15-tuxcare.3","6.0.15-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.15"},{"fixed":"6.0.15-tuxcare.5"}]}],"versions":["6.0.15","6.0.15-tuxcare.1","6.0.15-tuxcare.2","6.0.15-tuxcare.3","6.0.15-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.15"},{"fixed":"6.0.15-tuxcare.5"}]}],"versions":["6.0.15","6.0.15-tuxcare.1","6.0.15-tuxcare.2","6.0.15-tuxcare.3","6.0.15-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.15"},{"fixed":"6.0.15-tuxcare.5"}]}],"versions":["6.0.15","6.0.15-tuxcare.1","6.0.15-tuxcare.2","6.0.15-tuxcare.3","6.0.15-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.4"},{"fixed":"6.1.4-tuxcare.8"}]}],"versions":["6.1.4","6.1.4-tuxcare.1","6.1.4-tuxcare.2","6.1.4-tuxcare.3","6.1.4-tuxcare.4","6.1.4-tuxcare.5","6.1.4-tuxcare.6","6.1.4-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.4"},{"fixed":"6.1.4-tuxcare.8"}]}],"versions":["6.1.4","6.1.4-tuxcare.1","6.1.4-tuxcare.2","6.1.4-tuxcare.3","6.1.4-tuxcare.4","6.1.4-tuxcare.5","6.1.4-tuxcare.6","6.1.4-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.4"},{"fixed":"6.1.4-tuxcare.8"}]}],"versions":["6.1.4","6.1.4-tuxcare.1","6.1.4-tuxcare.2","6.1.4-tuxcare.3","6.1.4-tuxcare.4","6.1.4-tuxcare.5","6.1.4-tuxcare.6","6.1.4-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.15"},{"fixed":"6.1.15-tuxcare.6"}]}],"versions":["6.1.15","6.1.15-tuxcare.1","6.1.15-tuxcare.2","6.1.15-tuxcare.3","6.1.15-tuxcare.4","6.1.15-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.15"},{"fixed":"6.1.15-tuxcare.6"}]}],"versions":["6.1.15","6.1.15-tuxcare.1","6.1.15-tuxcare.2","6.1.15-tuxcare.3","6.1.15-tuxcare.4","6.1.15-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.14"},{"fixed":"6.1.14-tuxcare.3"}]}],"versions":["6.1.14","6.1.14-tuxcare.1","6.1.14-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.14"},{"fixed":"6.1.14-tuxcare.3"}]}],"versions":["6.1.14","6.1.14-tuxcare.1","6.1.14-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.14"},{"fixed":"6.1.14-tuxcare.3"}]}],"versions":["6.1.14","6.1.14-tuxcare.1","6.1.14-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.14"},{"fixed":"6.1.14-tuxcare.3"}]}],"versions":["6.1.14","6.1.14-tuxcare.1","6.1.14-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.7"},{"fixed":"6.1.7-tuxcare.8"}]}],"versions":["6.1.7","6.1.7-tuxcare.1","6.1.7-tuxcare.2","6.1.7-tuxcare.3","6.1.7-tuxcare.4","6.1.7-tuxcare.5","6.1.7-tuxcare.6","6.1.7-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.7"},{"fixed":"6.1.7-tuxcare.8"}]}],"versions":["6.1.7","6.1.7-tuxcare.1","6.1.7-tuxcare.2","6.1.7-tuxcare.3","6.1.7-tuxcare.4","6.1.7-tuxcare.5","6.1.7-tuxcare.6","6.1.7-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.7"},{"fixed":"6.1.7-tuxcare.8"}]}],"versions":["6.1.7","6.1.7-tuxcare.1","6.1.7-tuxcare.2","6.1.7-tuxcare.3","6.1.7-tuxcare.4","6.1.7-tuxcare.5","6.1.7-tuxcare.6","6.1.7-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.5"}]}],"versions":["6.2.5","6.2.5-tuxcare.1","6.2.5-tuxcare.2","6.2.5-tuxcare.3","6.2.5-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.5"}]}],"versions":["6.2.3","6.2.3-tuxcare.1","6.2.3-tuxcare.2","6.2.3-tuxcare.3","6.2.3-tuxcare.4"]},{"source":"osv","ecosystem":"Debian:12","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2","4.3.30-3","4.3.30-4"]},{"source":"osv","ecosystem":"Debian:13","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3","4.3.30-4"]},{"source":"osv","ecosystem":"Debian:14","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3","4.3.30-4"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.8"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.19"}]}],"versions":["6.2.0","6.2.1","6.2.10","6.2.11","6.2.12","6.2.13","6.2.14","6.2.15","6.2.16","6.2.17","6.2.18","6.2.2","6.2.3","6.2.4","6.2.5","6.2.6","6.2.7","6.2.8","6.2.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"last_affected":"6.1.21"}]}],"versions":["6.1.0","6.1.1","6.1.10","6.1.11","6.1.12","6.1.13","6.1.14","6.1.15","6.1.16","6.1.17","6.1.18","6.1.19","6.1.2","6.1.20","6.1.21","6.1.3","6.1.4","6.1.5","6.1.6","6.1.7","6.1.8","6.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.3.39"}]}],"versions":["5.0.0.RELEASE","5.0.1.RELEASE","5.0.10.RELEASE","5.0.11.RELEASE","5.0.12.RELEASE","5.0.13.RELEASE","5.0.14.RELEASE","5.0.15.RELEASE","5.0.16.RELEASE","5.0.17.RELEASE","5.0.18.RELEASE","5.0.19.RELEASE","5.0.2.RELEASE","5.0.20.RELEASE","5.0.3.RELEASE","5.0.4.RELEASE","5.0.5.RELEASE","5.0.6.RELEASE","5.0.7.RELEASE","5.0.8.RELEASE","5.0.9.RELEASE","5.1.0.RELEASE","5.1.1.RELEASE","5.1.10.RELEASE","5.1.11.RELEASE","5.1.12.RELEASE","5.1.13.RELEASE","5.1.14.RELEASE","5.1.15.RELEASE","5.1.16.RELEASE","5.1.17.RELEASE","5.1.18.RELEASE","5.1.19.RELEASE","5.1.2.RELEASE","5.1.20.RELEASE","5.1.3.RELEASE","5.1.4.RELEASE","5.1.5.RELEASE","5.1.6.RELEASE","5.1.7.RELEASE","5.1.8.RELEASE","5.1.9.RELEASE","5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.15.RELEASE","5.2.16.RELEASE","5.2.17.RELEASE","5.2.18.RELEASE","5.2.19.RELEASE","5.2.2.RELEASE","5.2.20.RELEASE","5.2.21.RELEASE","5.2.22.RELEASE","5.2.23.RELEASE","5.2.24.RELEASE","5.2.25.RELEASE","5.2.3.RELEASE","5.2.4.RELEASE","5.2.5.RELEASE","5.2.6.RELEASE","5.2.7.RELEASE","5.2.8.RELEASE","5.2.9.RELEASE","5.3.0","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.14","5.3.15","5.3.16","5.3.17","5.3.18","5.3.19","5.3.2","5.3.20","5.3.21","5.3.22","5.3.23","5.3.24","5.3.25","5.3.26","5.3.27","5.3.28","5.3.29","5.3.3","5.3.30","5.3.31","5.3.32","5.3.33","5.3.34","5.3.35","5.3.36","5.3.37","5.3.38","5.3.39","5.3.4","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.18.rhlw-00010"}]}],"versions":["5.0.0.RELEASE","5.0.1.RELEASE","5.0.10.RELEASE","5.0.11.RELEASE","5.0.12.RELEASE","5.0.13.RELEASE","5.0.14.RELEASE","5.0.15.RELEASE","5.0.16.RELEASE","5.0.17.RELEASE","5.0.18.RELEASE","5.0.19.RELEASE","5.0.2.RELEASE","5.0.20.RELEASE","5.0.3.RELEASE","5.0.4.RELEASE","5.0.5.RELEASE","5.0.6.RELEASE","5.0.7.RELEASE","5.0.8.RELEASE","5.0.9.RELEASE","5.1.0.RELEASE","5.1.1.RELEASE","5.1.10.RELEASE","5.1.11.RELEASE","5.1.12.RELEASE","5.1.13.RELEASE","5.1.14.RELEASE","5.1.15.RELEASE","5.1.16.RELEASE","5.1.17.RELEASE","5.1.18.RELEASE","5.1.19.RELEASE","5.1.2.RELEASE","5.1.20.RELEASE","5.1.3.RELEASE","5.1.4.RELEASE","5.1.5.RELEASE","5.1.6.RELEASE","5.1.7.RELEASE","5.1.8.RELEASE","5.1.9.RELEASE","5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.15.RELEASE","5.2.16.RELEASE","5.2.17.RELEASE","5.2.18.RELEASE","5.2.19.RELEASE","5.2.2.RELEASE","5.2.20.RELEASE","5.2.21.RELEASE","5.2.22.RELEASE","5.2.23.RELEASE","5.2.24.RELEASE","5.2.25.RELEASE","5.2.3.RELEASE","5.2.4.RELEASE","5.2.5.RELEASE","5.2.6.RELEASE","5.2.7.RELEASE","5.2.8.RELEASE","5.2.9.RELEASE","5.3.0","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.14","5.3.15","5.3.16","5.3.17","5.3.18","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9"],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.6.RELEASE-7","3.0.6.RELEASE-8","3.0.6.RELEASE-9","3.0.6.RELEASE-10","3.0.6.RELEASE-11","3.0.6.RELEASE-12","3.0.6.RELEASE-13","3.0.6.RELEASE-13ubuntu0.1~esm1","3.0.6.RELEASE-13ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.13-3","3.2.13-4","3.2.13-5","3.2.13-5ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.11-1","4.3.12-1","4.3.13-2","4.3.14-1","4.3.22-1~18.04","4.3.22-1~18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.22-4","4.3.22-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-1","4.3.30-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2","4.3.30-2ubuntu0.24.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2ubuntu1","4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]}],"products":[{"vendor":"spring","product":"spring framework"},{"vendor":"vmware","product":"spring framework"},{"vendor":"vmware","product":"spring_framework"}],"references":[{"url":"https://spring.io/security/cve-2026-41840","tags":["Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41840","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8","tags":["web"]},{"url":"https://github.com/advisories/GHSA-83f7-v6px-pp3h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41840.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41840","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-framework","tags":["package"]},{"url":"https://spring.io/security/cve-2024-38816","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38816","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cx7f-g6mp-7hqm","tags":["advisory"]},{"url":"https://spring.io/security/cve-2024-38819","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38819","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22735","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22737","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22741","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41839","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41842","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41844","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41847","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47892","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41840","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41840","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-41840","description":"Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.\nAffected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T03:50:15.174Z","modified":"2026-06-20T00:11:52.16Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-35327","description":"Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.\nAffected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T03:50:15Z","modified":"2026-06-20T00:11:52Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:35.26548Z"}],"ghsa":[{"id":"GHSA-83f7-v6px-pp3h","title":"Spring Framework Denial of Service via Multipart Requests in WebFlux","description":"Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T06:31:57Z","modified":"2026-07-30T15:20:16Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-401"],"updated_at":"2026-11-02T14:40:54.767849Z"}],"nvd":[{"id":"CVE-2026-41840","description":"Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.\nAffected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T05:16:35.967Z","modified":"2026-07-23T08:10:00.137Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:12:22.73178Z"}],"osv":[{"id":"CVE-2026-41840","description":"Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.\nAffected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T03:50:15.174Z","modified":"2026-11-10T02:32:10.323428686Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-401"],"updated_at":"2026-11-10T02:45:42.584685Z"},{"id":"DEBIAN-CVE-2026-41840","description":"Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T05:16:35.967Z","modified":"2026-10-01T03:03:04.692252117Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-83f7-v6px-pp3h","title":"Spring Framework Denial of Service via Multipart Requests in WebFlux","description":"Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T06:31:57Z","modified":"2026-09-10T03:51:08.286303497Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-401"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"UBUNTU-CVE-2026-41840","description":"Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T05:16:00Z","modified":"2026-10-17T13:00:04.003927906Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"CLSA-2026-1785952964","title":"TuxCare security update for org.springframework (14 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 14 CVEs. Fixed in 6.2.15-tuxcare.3.","status":"published","published":"2026-08-05T18:02:44Z","modified":"2026-11-02T19:45:48.182834652Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1785969383","title":"TuxCare security update for org.springframework (4 CVEs)","description":"TuxCare rebuilt 2 org.springframework packages to address 4 CVEs. Fixed in 5.3.39-tuxcare.18.","status":"published","published":"2026-08-05T22:36:23Z","modified":"2026-10-30T07:30:29.012170338Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1787728788","title":"TuxCare security update for org.springframework (9 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 9 CVEs. Fixed in 6.2.13-tuxcare.1.","status":"published","published":"2026-08-26T07:19:48Z","modified":"2026-11-02T19:45:57.948706688Z","updated_at":"2026-11-02T20:29:49.757752Z"},{"id":"CLSA-2026-1788253139","title":"TuxCare security update for org.springframework (20 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 20 CVEs. Fixed in 6.2.1-tuxcare.4.","status":"published","published":"2026-09-01T08:58:59Z","modified":"2026-11-02T19:46:02.08031646Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1789218209","title":"TuxCare security update for org.springframework:spring-webflux (1 CVE)","description":"TuxCare rebuilt org.springframework:spring-webflux to address 1 CVE. Fixed in 6.1.21-tuxcare.13.","status":"published","published":"2026-09-12T13:03:29Z","modified":"2026-10-30T07:30:42.5065217Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789722420","title":"TuxCare security update for org.springframework (34 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 34 CVEs. Fixed in 6.2.12-tuxcare.1.","status":"published","published":"2026-09-18T09:07:00Z","modified":"2026-11-02T19:46:18.4339041Z","updated_at":"2026-11-02T20:29:28.838259Z"},{"id":"CLSA-2026-1790068772","title":"TuxCare security update for org.springframework (36 CVEs)","description":"TuxCare rebuilt 11 org.springframework packages to address 36 CVEs. Fixed in 6.1.18-tuxcare.1.","status":"published","published":"2026-09-22T09:19:32Z","modified":"2026-11-02T19:46:19.638710531Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1790068919","title":"TuxCare security update for org.springframework (33 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 33 CVEs. Fixed in 6.2.14-tuxcare.1.","status":"published","published":"2026-09-22T09:21:59Z","modified":"2026-11-02T19:46:21.56620398Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1790082496","title":"TuxCare security update for org.springframework:spring-webflux (1 CVE)","description":"TuxCare rebuilt org.springframework:spring-webflux to address 1 CVE. Fixed in 6.1.20-tuxcare.11.","status":"published","published":"2026-09-22T13:08:16Z","modified":"2026-10-30T07:30:23.634831685Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790082526","title":"TuxCare security update for org.springframework:spring-webflux (1 CVE)","description":"TuxCare rebuilt org.springframework:spring-webflux to address 1 CVE. Fixed in 6.1.19-tuxcare.5.","status":"published","published":"2026-09-22T13:08:46Z","modified":"2026-10-30T07:30:23.640774482Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790694250","title":"TuxCare security update for org.springframework (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework packages to address 3 CVEs. Fixed in 5.3.33-tuxcare.2.","status":"published","published":"2026-09-29T15:04:10Z","modified":"2026-11-02T19:46:25.361638298Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1791280908","title":"TuxCare security update for org.springframework (10 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 10 CVEs. Fixed in 6.0.23-tuxcare.11.","status":"published","published":"2026-10-06T10:01:48Z","modified":"2026-11-02T19:46:26.235597303Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791281988","title":"TuxCare security update for org.springframework (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework packages to address 4 CVEs. Fixed in 6.1.16-tuxcare.7.","status":"published","published":"2026-10-06T10:19:48Z","modified":"2026-11-02T19:46:26.295328498Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791390736","title":"TuxCare security update for org.springframework (6 CVEs)","description":"TuxCare rebuilt 4 org.springframework packages to address 6 CVEs. Fixed in 6.0.16-tuxcare.10.","status":"published","published":"2026-10-07T16:32:16Z","modified":"2026-11-02T19:46:26.25485961Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1792584150","title":"TuxCare security update for org.springframework (5 CVEs)","description":"TuxCare rebuilt 4 org.springframework packages to address 5 CVEs. Fixed in 6.1.13-tuxcare.4.","status":"published","published":"2026-10-21T12:02:30Z","modified":"2026-11-02T19:46:29.606399232Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792585518","title":"TuxCare security update for org.springframework (8 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 8 CVEs. Fixed in 6.0.12-tuxcare.6.","status":"published","published":"2026-10-21T12:25:18Z","modified":"2026-11-02T19:46:30.210453596Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792585696","title":"TuxCare security update for org.springframework (8 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 8 CVEs. Fixed in 6.0.11-tuxcare.6.","status":"published","published":"2026-10-21T12:28:16Z","modified":"2026-11-02T19:46:30.446294422Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792587283","title":"TuxCare security update for org.springframework (9 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 9 CVEs. Fixed in 6.0.0-tuxcare.5.","status":"published","published":"2026-10-21T12:54:43Z","modified":"2026-11-02T19:46:29.88334372Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792588215","title":"TuxCare security update for org.springframework (8 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 8 CVEs. Fixed in 6.0.14-tuxcare.2.","status":"published","published":"2026-10-21T13:10:15Z","modified":"2026-11-02T19:46:29.685633571Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792590675","title":"TuxCare security update for org.springframework (32 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 32 CVEs. Fixed in 6.2.7-tuxcare.1.","status":"published","published":"2026-10-21T13:51:15Z","modified":"2026-11-02T19:46:29.936376767Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792591234","title":"TuxCare security update for org.springframework (8 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 8 CVEs. Fixed in 6.0.13-tuxcare.6.","status":"published","published":"2026-10-21T14:00:34Z","modified":"2026-11-02T19:46:29.758300591Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792599701","title":"TuxCare security update for org.springframework (7 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 7 CVEs. Fixed in 5.3.32-tuxcare.2.","status":"published","published":"2026-10-21T16:21:41Z","modified":"2026-11-02T19:46:30.280864985Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792600420","title":"TuxCare security update for org.springframework (7 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 7 CVEs. Fixed in 6.0.15-tuxcare.5.","status":"published","published":"2026-10-21T16:33:40Z","modified":"2026-11-02T19:46:29.619856524Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792600478","title":"TuxCare security update for org.springframework (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework packages to address 3 CVEs. Fixed in 6.1.4-tuxcare.8.","status":"published","published":"2026-10-21T16:34:38Z","modified":"2026-11-02T19:46:29.732951761Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792600502","title":"TuxCare security update for org.springframework (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 6.1.15-tuxcare.6.","status":"published","published":"2026-10-21T16:35:02Z","modified":"2026-11-02T19:46:30.673049178Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792600685","title":"TuxCare security update for org.springframework (5 CVEs)","description":"TuxCare rebuilt 4 org.springframework packages to address 5 CVEs. Fixed in 6.1.14-tuxcare.3.","status":"published","published":"2026-10-21T16:38:05Z","modified":"2026-11-02T19:46:30.511678637Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792601217","title":"TuxCare security update for org.springframework (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework packages to address 3 CVEs. Fixed in 6.1.7-tuxcare.8.","status":"published","published":"2026-10-21T16:46:57Z","modified":"2026-11-02T19:46:30.564046878Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1794179109","title":"TuxCare security update for org.springframework:spring-webflux (1 CVE)","description":"TuxCare rebuilt org.springframework:spring-webflux to address 1 CVE. Fixed in 6.2.5-tuxcare.5.","status":"published","published":"2026-11-09T00:05:10Z","modified":"2026-11-09T01:45:05.339371194Z","updated_at":"2026-11-09T02:15:19.582074Z"},{"id":"CLSA-2026-1794180285","title":"TuxCare security update for org.springframework:spring-webflux (1 CVE)","description":"TuxCare rebuilt org.springframework:spring-webflux to address 1 CVE. Fixed in 6.2.3-tuxcare.5.","status":"published","published":"2026-11-09T00:24:46Z","modified":"2026-11-09T07:15:03.288418487Z","updated_at":"2026-11-09T07:20:29.20536Z"},{"id":"RHLW-2026-8ef16ddaa2e22182","title":"Lightwell Security Advisory: spring-webflux 5.3.18.rhlw-00010","description":"Red Hat Lightwell has released org.springframework:spring-webflux 5.3.18.rhlw-00010 with backported fixes for CVE-2024-38816, CVE-2024-38819, CVE-2026-22735, CVE-2026-22737, CVE-2026-22740, CVE-2026-22741, CVE-2026-22745, CVE-2026-41839, CVE-2026-41840, CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41847, CVE-2026-41853, and CVE-2026-47892.\n\nCVE-2024-38816: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n\nSpecifically, an application is vulnerable when both of the following are true:\n\n  *  the web application uses RouterFunctions to serve static resources\n  *  resource handling is explicitly configured with a FileSystemResource location\n\n\nHowever, malicious requests are blocked and rejected when any of the following is true:\n\n  *  the  Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use\n  *  the application runs on Tomcat or Jetty\n\nCVE-2024-38819: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n\nThis patched artifact is a drop-in replacement for org.springframework:spring-webflux 5.3.18 from Maven Central.","status":"published","published":"2026-10-12T16:59:51Z","modified":"2026-10-27T04:00:12.251420115Z","updated_at":"2026-11-02T15:52:58.636919Z"}]}}