{"id":"CVE-2026-41847","aliases":["CLSA-2026-1785939604","CLSA-2026-1785954263","CLSA-2026-1785957662","CLSA-2026-1785969383","CLSA-2026-1786339580","CLSA-2026-1786552823","CLSA-2026-1786609560","CLSA-2026-1787246263","CLSA-2026-1787317970","CLSA-2026-1788372470","CLSA-2026-1789427454","CLSA-2026-1790070671","CLSA-2026-1790234279","CLSA-2026-1793615948","CLSA-2026-1793616969","CLSA-2026-1793620971","CLSA-2026-1793630574","CLSA-2026-1793632081","CLSA-2026-1793638642","CLSA-2026-1793881978","CLSA-2026-1793883499","CLSA-2026-1793884148","CLSA-2026-1793884738","CLSA-2026-1793885497","CLSA-2026-1794157893","DEBIAN-CVE-2026-41847","EUVD-2026-35335","GHSA-cx7f-g6mp-7hqm","GHSA-g5vr-rgqm-vf78","GHSA-vqgp-pf68-6947","RHLW-2026-8ef16ddaa2e22182","UBUNTU-CVE-2026-41847"],"status":"published","title":"Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL","description":"Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.\n\nAffected versions:\nSpring Framework 5.3.0 through 5.3.48.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00166,"percentile":0.05903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-06-09T03:51:03Z","modified":"2026-11-08T19:30:02Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.3.39"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.30"},{"fixed":"5.3.30-tuxcare.5"}]}],"versions":["5.3.30","5.3.30-tuxcare.1","5.3.30-tuxcare.2","5.3.30-tuxcare.3","5.3.30-tuxcare.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.30"},{"fixed":"5.3.30-tuxcare.5"}]}],"versions":["5.3.30","5.3.30-tuxcare.1","5.3.30-tuxcare.2","5.3.30-tuxcare.3","5.3.30-tuxcare.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.30"},{"fixed":"5.3.30-tuxcare.5"}]}],"versions":["5.3.30","5.3.30-tuxcare.1","5.3.30-tuxcare.2","5.3.30-tuxcare.3","5.3.30-tuxcare.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.30"},{"fixed":"5.3.30-tuxcare.5"}]}],"versions":["5.3.30","5.3.30-tuxcare.1","5.3.30-tuxcare.2","5.3.30-tuxcare.3","5.3.30-tuxcare.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.30"},{"fixed":"5.3.30-tuxcare.5"}]}],"versions":["5.3.30","5.3.30-tuxcare.1","5.3.30-tuxcare.2","5.3.30-tuxcare.3","5.3.30-tuxcare.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.30"},{"fixed":"5.3.30-tuxcare.5"}]}],"versions":["5.3.30","5.3.30-tuxcare.1","5.3.30-tuxcare.2","5.3.30-tuxcare.3","5.3.30-tuxcare.4"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.37"},{"fixed":"5.3.37-tuxcare.9"}]}],"versions":["5.3.37","5.3.37-tuxcare.1","5.3.37-tuxcare.2","5.3.37-tuxcare.3","5.3.37-tuxcare.4","5.3.37-tuxcare.5","5.3.37-tuxcare.6","5.3.37-tuxcare.7","5.3.37-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.37"},{"fixed":"5.3.37-tuxcare.9"}]}],"versions":["5.3.37","5.3.37-tuxcare.1","5.3.37-tuxcare.2","5.3.37-tuxcare.3","5.3.37-tuxcare.4","5.3.37-tuxcare.5","5.3.37-tuxcare.6","5.3.37-tuxcare.7","5.3.37-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.37"},{"fixed":"5.3.37-tuxcare.9"}]}],"versions":["5.3.37","5.3.37-tuxcare.1","5.3.37-tuxcare.2","5.3.37-tuxcare.3","5.3.37-tuxcare.4","5.3.37-tuxcare.5","5.3.37-tuxcare.6","5.3.37-tuxcare.7","5.3.37-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.37"},{"fixed":"5.3.37-tuxcare.9"}]}],"versions":["5.3.37","5.3.37-tuxcare.1","5.3.37-tuxcare.2","5.3.37-tuxcare.3","5.3.37-tuxcare.4","5.3.37-tuxcare.5","5.3.37-tuxcare.6","5.3.37-tuxcare.7","5.3.37-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.37"},{"fixed":"5.3.37-tuxcare.9"}]}],"versions":["5.3.37","5.3.37-tuxcare.1","5.3.37-tuxcare.2","5.3.37-tuxcare.3","5.3.37-tuxcare.4","5.3.37-tuxcare.5","5.3.37-tuxcare.6","5.3.37-tuxcare.7","5.3.37-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.7"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3","5.2.13.RELEASE-tuxcare.4","5.2.13.RELEASE-tuxcare.5","5.2.13.RELEASE-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.7"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3","5.2.13.RELEASE-tuxcare.4","5.2.13.RELEASE-tuxcare.5","5.2.13.RELEASE-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.7"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3","5.2.13.RELEASE-tuxcare.4","5.2.13.RELEASE-tuxcare.5","5.2.13.RELEASE-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.7"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3","5.2.13.RELEASE-tuxcare.4","5.2.13.RELEASE-tuxcare.5","5.2.13.RELEASE-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.39"},{"fixed":"5.3.39-tuxcare.18"}]}],"versions":["5.3.39","5.3.39-tuxcare.10","5.3.39-tuxcare.11","5.3.39-tuxcare.12","5.3.39-tuxcare.13","5.3.39-tuxcare.14","5.3.39-tuxcare.15","5.3.39-tuxcare.16","5.3.39-tuxcare.17","5.3.39-tuxcare.7","5.3.39-tuxcare.8","5.3.39-tuxcare.9","5.3.39.tuxcare.1","5.3.39.tuxcare.3","5.3.39.tuxcare.4","5.3.39.tuxcare.5","5.3.39.tuxcare.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.39"},{"fixed":"5.3.39-tuxcare.18"}]}],"versions":["5.3.39","5.3.39-tuxcare.10","5.3.39-tuxcare.11","5.3.39-tuxcare.12","5.3.39-tuxcare.13","5.3.39-tuxcare.14","5.3.39-tuxcare.15","5.3.39-tuxcare.16","5.3.39-tuxcare.17","5.3.39-tuxcare.7","5.3.39-tuxcare.8","5.3.39-tuxcare.9","5.3.39.tuxcare.1","5.3.39.tuxcare.3","5.3.39.tuxcare.4","5.3.39.tuxcare.5","5.3.39.tuxcare.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.24"},{"fixed":"5.3.24-tuxcare.5"}]}],"versions":["5.3.24","5.3.24-tuxcare.1","5.3.24-tuxcare.2","5.3.24-tuxcare.3","5.3.24-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.24"},{"fixed":"5.3.24-tuxcare.5"}]}],"versions":["5.3.24","5.3.24-tuxcare.1","5.3.24-tuxcare.2","5.3.24-tuxcare.3","5.3.24-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.5"}]}],"versions":["5.3.7","5.3.7-tuxcare.1","5.3.7-tuxcare.2","5.3.7-tuxcare.3","5.3.7-tuxcare.4"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.5"}]}],"versions":["5.3.7","5.3.7-tuxcare.1","5.3.7-tuxcare.2","5.3.7-tuxcare.3","5.3.7-tuxcare.4"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.5"}]}],"versions":["5.3.7","5.3.7-tuxcare.1","5.3.7-tuxcare.2","5.3.7-tuxcare.3","5.3.7-tuxcare.4"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.5"}]}],"versions":["5.3.7","5.3.7-tuxcare.1","5.3.7-tuxcare.2","5.3.7-tuxcare.3","5.3.7-tuxcare.4"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.5"}]}],"versions":["5.3.7","5.3.7-tuxcare.1","5.3.7-tuxcare.2","5.3.7-tuxcare.3","5.3.7-tuxcare.4"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.29"},{"fixed":"5.3.29-tuxcare.6"}]}],"versions":["5.3.29","5.3.29-tuxcare.1","5.3.29-tuxcare.2","5.3.29-tuxcare.3","5.3.29-tuxcare.4","5.3.29-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.29"},{"fixed":"5.3.29-tuxcare.6"}]}],"versions":["5.3.29","5.3.29-tuxcare.1","5.3.29-tuxcare.2","5.3.29-tuxcare.3","5.3.29-tuxcare.4","5.3.29-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.29"},{"fixed":"5.3.29-tuxcare.6"}]}],"versions":["5.3.29","5.3.29-tuxcare.1","5.3.29-tuxcare.2","5.3.29-tuxcare.3","5.3.29-tuxcare.4","5.3.29-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.29"},{"fixed":"5.3.29-tuxcare.6"}]}],"versions":["5.3.29","5.3.29-tuxcare.1","5.3.29-tuxcare.2","5.3.29-tuxcare.3","5.3.29-tuxcare.4","5.3.29-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.29"},{"fixed":"5.3.29-tuxcare.6"}]}],"versions":["5.3.29","5.3.29-tuxcare.1","5.3.29-tuxcare.2","5.3.29-tuxcare.3","5.3.29-tuxcare.4","5.3.29-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.31"},{"fixed":"5.3.31-tuxcare.11"}]}],"versions":["5.3.31","5.3.31-tuxcare.1","5.3.31-tuxcare.10","5.3.31-tuxcare.2","5.3.31-tuxcare.3","5.3.31-tuxcare.4","5.3.31-tuxcare.5","5.3.31-tuxcare.6","5.3.31-tuxcare.7","5.3.31-tuxcare.8","5.3.31-tuxcare.9","5.3.31.tuxcare"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.31"},{"fixed":"5.3.31-tuxcare.11"}]}],"versions":["5.3.31","5.3.31-tuxcare.1","5.3.31-tuxcare.10","5.3.31-tuxcare.2","5.3.31-tuxcare.3","5.3.31-tuxcare.4","5.3.31-tuxcare.5","5.3.31-tuxcare.6","5.3.31-tuxcare.7","5.3.31-tuxcare.8","5.3.31-tuxcare.9","5.3.31.tuxcare"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.31"},{"fixed":"5.3.31-tuxcare.11"}]}],"versions":["5.3.31","5.3.31-tuxcare.1","5.3.31-tuxcare.10","5.3.31-tuxcare.2","5.3.31-tuxcare.3","5.3.31-tuxcare.4","5.3.31-tuxcare.5","5.3.31-tuxcare.6","5.3.31-tuxcare.7","5.3.31-tuxcare.8","5.3.31-tuxcare.9","5.3.31.tuxcare"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.4"}]}],"versions":["5.2.0.RELEASE","5.2.0.RELEASE-tuxcare.1","5.2.0.RELEASE-tuxcare.2","5.2.0.RELEASE-tuxcare.3"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.4"}]}],"versions":["5.2.0.RELEASE","5.2.0.RELEASE-tuxcare.1","5.2.0.RELEASE-tuxcare.2","5.2.0.RELEASE-tuxcare.3"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.4"}]}],"versions":["5.2.0.RELEASE","5.2.0.RELEASE-tuxcare.1","5.2.0.RELEASE-tuxcare.2","5.2.0.RELEASE-tuxcare.3"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.4"}]}],"versions":["5.2.0.RELEASE","5.2.0.RELEASE-tuxcare.1","5.2.0.RELEASE-tuxcare.2","5.2.0.RELEASE-tuxcare.3"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.4"}]}],"versions":["5.2.0.RELEASE","5.2.0.RELEASE-tuxcare.1","5.2.0.RELEASE-tuxcare.2","5.2.0.RELEASE-tuxcare.3"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.4"}]}],"versions":["5.2.0.RELEASE","5.2.0.RELEASE-tuxcare.1","5.2.0.RELEASE-tuxcare.2","5.2.0.RELEASE-tuxcare.3"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.4"}]}],"versions":["5.2.0.RELEASE","5.2.0.RELEASE-tuxcare.1","5.2.0.RELEASE-tuxcare.2","5.2.0.RELEASE-tuxcare.3"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.1"}]}],"versions":["5.3.33"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.1"}]}],"versions":["5.3.33"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.1"}]}],"versions":["5.3.33"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.1"}]}],"versions":["5.3.33"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.1"}]}],"versions":["5.3.33"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.1"}]}],"versions":["5.3.33"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.1"}]}],"versions":["5.3.33"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.1"}]}],"versions":["5.3.33"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.1"}]}],"versions":["5.3.33"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.1"}]}],"versions":["5.3.33"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.33"},{"fixed":"5.3.33-tuxcare.1"}]}],"versions":["5.3.33"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.17.RELEASE"},{"fixed":"5.2.17.RELEASE-tuxcare.1"}]}],"versions":["5.2.17.RELEASE"],"bundled":27},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.17.RELEASE"},{"fixed":"5.2.17.RELEASE-tuxcare.1"}]}],"versions":["5.2.17.RELEASE"],"bundled":27},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.17.RELEASE"},{"fixed":"5.2.17.RELEASE-tuxcare.1"}]}],"versions":["5.2.17.RELEASE"],"bundled":27},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.17.RELEASE"},{"fixed":"5.2.17.RELEASE-tuxcare.1"}]}],"versions":["5.2.17.RELEASE"],"bundled":27},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.17.RELEASE"},{"fixed":"5.2.17.RELEASE-tuxcare.1"}]}],"versions":["5.2.17.RELEASE"],"bundled":27},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.17.RELEASE"},{"fixed":"5.2.17.RELEASE-tuxcare.1"}]}],"versions":["5.2.17.RELEASE"],"bundled":27},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.17.RELEASE"},{"fixed":"5.2.17.RELEASE-tuxcare.1"}]}],"versions":["5.2.17.RELEASE"],"bundled":27},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.17.RELEASE"},{"fixed":"5.2.17.RELEASE-tuxcare.1"}]}],"versions":["5.2.17.RELEASE"],"bundled":27},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.7.RELEASE"},{"fixed":"5.2.7.RELEASE-tuxcare.3"}]}],"versions":["5.2.7.RELEASE","5.2.7.RELEASE-tuxcare.1","5.2.7.RELEASE-tuxcare.2"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.7.RELEASE"},{"fixed":"5.2.7.RELEASE-tuxcare.3"}]}],"versions":["5.2.7.RELEASE","5.2.7.RELEASE-tuxcare.1","5.2.7.RELEASE-tuxcare.2"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.7.RELEASE"},{"fixed":"5.2.7.RELEASE-tuxcare.3"}]}],"versions":["5.2.7.RELEASE","5.2.7.RELEASE-tuxcare.1","5.2.7.RELEASE-tuxcare.2"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.7.RELEASE"},{"fixed":"5.2.7.RELEASE-tuxcare.3"}]}],"versions":["5.2.7.RELEASE","5.2.7.RELEASE-tuxcare.1","5.2.7.RELEASE-tuxcare.2"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.7.RELEASE"},{"fixed":"5.2.7.RELEASE-tuxcare.3"}]}],"versions":["5.2.7.RELEASE","5.2.7.RELEASE-tuxcare.1","5.2.7.RELEASE-tuxcare.2"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.7.RELEASE"},{"fixed":"5.2.7.RELEASE-tuxcare.3"}]}],"versions":["5.2.7.RELEASE","5.2.7.RELEASE-tuxcare.1","5.2.7.RELEASE-tuxcare.2"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.7.RELEASE"},{"fixed":"5.2.7.RELEASE-tuxcare.3"}]}],"versions":["5.2.7.RELEASE","5.2.7.RELEASE-tuxcare.1","5.2.7.RELEASE-tuxcare.2"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.7.RELEASE"},{"fixed":"5.2.7.RELEASE-tuxcare.3"}]}],"versions":["5.2.7.RELEASE","5.2.7.RELEASE-tuxcare.1","5.2.7.RELEASE-tuxcare.2"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.7.RELEASE"},{"fixed":"5.2.7.RELEASE-tuxcare.3"}]}],"versions":["5.2.7.RELEASE","5.2.7.RELEASE-tuxcare.1","5.2.7.RELEASE-tuxcare.2"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.9.RELEASE"},{"fixed":"5.2.9.RELEASE-tuxcare.2"}]}],"versions":["5.2.9.RELEASE","5.2.9.RELEASE-tuxcare.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.9.RELEASE"},{"fixed":"5.2.9.RELEASE-tuxcare.2"}]}],"versions":["5.2.9.RELEASE","5.2.9.RELEASE-tuxcare.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.9.RELEASE"},{"fixed":"5.2.9.RELEASE-tuxcare.2"}]}],"versions":["5.2.9.RELEASE","5.2.9.RELEASE-tuxcare.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.9.RELEASE"},{"fixed":"5.2.9.RELEASE-tuxcare.2"}]}],"versions":["5.2.9.RELEASE","5.2.9.RELEASE-tuxcare.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.9.RELEASE"},{"fixed":"5.2.9.RELEASE-tuxcare.2"}]}],"versions":["5.2.9.RELEASE","5.2.9.RELEASE-tuxcare.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.9.RELEASE"},{"fixed":"5.2.9.RELEASE-tuxcare.2"}]}],"versions":["5.2.9.RELEASE","5.2.9.RELEASE-tuxcare.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.9.RELEASE"},{"fixed":"5.2.9.RELEASE-tuxcare.2"}]}],"versions":["5.2.9.RELEASE","5.2.9.RELEASE-tuxcare.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.9.RELEASE"},{"fixed":"5.2.9.RELEASE-tuxcare.2"}]}],"versions":["5.2.9.RELEASE","5.2.9.RELEASE-tuxcare.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.9.RELEASE"},{"fixed":"5.2.9.RELEASE-tuxcare.2"}]}],"versions":["5.2.9.RELEASE","5.2.9.RELEASE-tuxcare.1"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.10.RELEASE"},{"fixed":"5.2.10.RELEASE-tuxcare.3"}]}],"versions":["5.2.10.RELEASE","5.2.10.RELEASE-tuxcare.1","5.2.10.RELEASE-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.4"}]}],"versions":["5.3.23","5.3.23-tuxcare.1","5.3.23-tuxcare.2","5.3.23-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.4"}]}],"versions":["5.3.23","5.3.23-tuxcare.1","5.3.23-tuxcare.2","5.3.23-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.4"}]}],"versions":["5.3.23","5.3.23-tuxcare.1","5.3.23-tuxcare.2","5.3.23-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.4"}]}],"versions":["5.3.23","5.3.23-tuxcare.1","5.3.23-tuxcare.2","5.3.23-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.4"}]}],"versions":["5.3.23","5.3.23-tuxcare.1","5.3.23-tuxcare.2","5.3.23-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.4"}]}],"versions":["5.3.23","5.3.23-tuxcare.1","5.3.23-tuxcare.2","5.3.23-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.4"}]}],"versions":["5.3.23","5.3.23-tuxcare.1","5.3.23-tuxcare.2","5.3.23-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.5"}]}],"versions":["5.3.13","5.3.13-tuxcare.1","5.3.13-tuxcare.2","5.3.13-tuxcare.3","5.3.13-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.5"}]}],"versions":["5.3.13","5.3.13-tuxcare.1","5.3.13-tuxcare.2","5.3.13-tuxcare.3","5.3.13-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.5"}]}],"versions":["5.3.13","5.3.13-tuxcare.1","5.3.13-tuxcare.2","5.3.13-tuxcare.3","5.3.13-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.5"}]}],"versions":["5.3.13","5.3.13-tuxcare.1","5.3.13-tuxcare.2","5.3.13-tuxcare.3","5.3.13-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.5"}]}],"versions":["5.3.13","5.3.13-tuxcare.1","5.3.13-tuxcare.2","5.3.13-tuxcare.3","5.3.13-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.5"}]}],"versions":["5.3.13","5.3.13-tuxcare.1","5.3.13-tuxcare.2","5.3.13-tuxcare.3","5.3.13-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.25.RELEASE"},{"fixed":"5.2.25.RELEASE-tuxcare.4"}]}],"versions":["5.2.25.RELEASE","5.2.25.RELEASE-tuxcare.1","5.2.25.RELEASE-tuxcare.2","5.2.25.RELEASE-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.25.RELEASE"},{"fixed":"5.2.25.RELEASE-tuxcare.4"}]}],"versions":["5.2.25.RELEASE","5.2.25.RELEASE-tuxcare.1","5.2.25.RELEASE-tuxcare.2","5.2.25.RELEASE-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.25.RELEASE"},{"fixed":"5.2.25.RELEASE-tuxcare.4"}]}],"versions":["5.2.25.RELEASE","5.2.25.RELEASE-tuxcare.1","5.2.25.RELEASE-tuxcare.2","5.2.25.RELEASE-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.25.RELEASE"},{"fixed":"5.2.25.RELEASE-tuxcare.4"}]}],"versions":["5.2.25.RELEASE","5.2.25.RELEASE-tuxcare.1","5.2.25.RELEASE-tuxcare.2","5.2.25.RELEASE-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.20"},{"fixed":"5.3.20-tuxcare.4"}]}],"versions":["5.3.20","5.3.20-tuxcare.1","5.3.20-tuxcare.2","5.3.20-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.20"},{"fixed":"5.3.20-tuxcare.4"}]}],"versions":["5.3.20","5.3.20-tuxcare.1","5.3.20-tuxcare.2","5.3.20-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.20"},{"fixed":"5.3.20-tuxcare.4"}]}],"versions":["5.3.20","5.3.20-tuxcare.1","5.3.20-tuxcare.2","5.3.20-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.20"},{"fixed":"5.3.20-tuxcare.4"}]}],"versions":["5.3.20","5.3.20-tuxcare.1","5.3.20-tuxcare.2","5.3.20-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.20"},{"fixed":"5.3.20-tuxcare.4"}]}],"versions":["5.3.20","5.3.20-tuxcare.1","5.3.20-tuxcare.2","5.3.20-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8.RELEASE"},{"fixed":"5.2.8.RELEASE-tuxcare.3"}]}],"versions":["5.2.8.RELEASE","5.2.8.RELEASE-tuxcare.1","5.2.8.RELEASE-tuxcare.2"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8.RELEASE"},{"fixed":"5.2.8.RELEASE-tuxcare.3"}]}],"versions":["5.2.8.RELEASE","5.2.8.RELEASE-tuxcare.1","5.2.8.RELEASE-tuxcare.2"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8.RELEASE"},{"fixed":"5.2.8.RELEASE-tuxcare.3"}]}],"versions":["5.2.8.RELEASE","5.2.8.RELEASE-tuxcare.1","5.2.8.RELEASE-tuxcare.2"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8.RELEASE"},{"fixed":"5.2.8.RELEASE-tuxcare.3"}]}],"versions":["5.2.8.RELEASE","5.2.8.RELEASE-tuxcare.1","5.2.8.RELEASE-tuxcare.2"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8.RELEASE"},{"fixed":"5.2.8.RELEASE-tuxcare.3"}]}],"versions":["5.2.8.RELEASE","5.2.8.RELEASE-tuxcare.1","5.2.8.RELEASE-tuxcare.2"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8.RELEASE"},{"fixed":"5.2.8.RELEASE-tuxcare.3"}]}],"versions":["5.2.8.RELEASE","5.2.8.RELEASE-tuxcare.1","5.2.8.RELEASE-tuxcare.2"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8.RELEASE"},{"fixed":"5.2.8.RELEASE-tuxcare.3"}]}],"versions":["5.2.8.RELEASE","5.2.8.RELEASE-tuxcare.1","5.2.8.RELEASE-tuxcare.2"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.8.RELEASE"},{"fixed":"5.2.8.RELEASE-tuxcare.3"}]}],"versions":["5.2.8.RELEASE","5.2.8.RELEASE-tuxcare.1","5.2.8.RELEASE-tuxcare.2"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.4"}]}],"versions":["5.3.3","5.3.3-tuxcare.1","5.3.3-tuxcare.2","5.3.3-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.4"}]}],"versions":["5.3.3","5.3.3-tuxcare.1","5.3.3-tuxcare.2","5.3.3-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.4"}]}],"versions":["5.3.3","5.3.3-tuxcare.1","5.3.3-tuxcare.2","5.3.3-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.4"}]}],"versions":["5.3.3","5.3.3-tuxcare.1","5.3.3-tuxcare.2","5.3.3-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.4"}]}],"versions":["5.3.3","5.3.3-tuxcare.1","5.3.3-tuxcare.2","5.3.3-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.4"}]}],"versions":["5.3.3","5.3.3-tuxcare.1","5.3.3-tuxcare.2","5.3.3-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.4"}]}],"versions":["5.3.3","5.3.3-tuxcare.1","5.3.3-tuxcare.2","5.3.3-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.4"}]}],"versions":["5.2.11.RELEASE","5.2.11.RELEASE-tuxcare.1","5.2.11.RELEASE-tuxcare.2","5.2.11.RELEASE-tuxcare.3"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.4"}]}],"versions":["5.2.11.RELEASE","5.2.11.RELEASE-tuxcare.1","5.2.11.RELEASE-tuxcare.2","5.2.11.RELEASE-tuxcare.3"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.4"}]}],"versions":["5.2.11.RELEASE","5.2.11.RELEASE-tuxcare.1","5.2.11.RELEASE-tuxcare.2","5.2.11.RELEASE-tuxcare.3"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.4"}]}],"versions":["5.2.11.RELEASE","5.2.11.RELEASE-tuxcare.1","5.2.11.RELEASE-tuxcare.2","5.2.11.RELEASE-tuxcare.3"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.4"}]}],"versions":["5.2.11.RELEASE","5.2.11.RELEASE-tuxcare.1","5.2.11.RELEASE-tuxcare.2","5.2.11.RELEASE-tuxcare.3"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.4"}]}],"versions":["5.2.11.RELEASE","5.2.11.RELEASE-tuxcare.1","5.2.11.RELEASE-tuxcare.2","5.2.11.RELEASE-tuxcare.3"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.11.RELEASE"},{"fixed":"5.2.11.RELEASE-tuxcare.4"}]}],"versions":["5.2.11.RELEASE","5.2.11.RELEASE-tuxcare.1","5.2.11.RELEASE-tuxcare.2","5.2.11.RELEASE-tuxcare.3"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.15"},{"fixed":"5.3.15-tuxcare.3"}]}],"versions":["5.3.15","5.3.15-tuxcare.1","5.3.15-tuxcare.2"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.15"},{"fixed":"5.3.15-tuxcare.3"}]}],"versions":["5.3.15","5.3.15-tuxcare.1","5.3.15-tuxcare.2"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.15"},{"fixed":"5.3.15-tuxcare.3"}]}],"versions":["5.3.15","5.3.15-tuxcare.1","5.3.15-tuxcare.2"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.15"},{"fixed":"5.3.15-tuxcare.3"}]}],"versions":["5.3.15","5.3.15-tuxcare.1","5.3.15-tuxcare.2"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.15"},{"fixed":"5.3.15-tuxcare.3"}]}],"versions":["5.3.15","5.3.15-tuxcare.1","5.3.15-tuxcare.2"],"bundled":16},{"source":"osv","ecosystem":"Debian:12","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2","4.3.30-3","4.3.30-4"]},{"source":"osv","ecosystem":"Debian:13","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3","4.3.30-4"]},{"source":"osv","ecosystem":"Debian:14","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3","4.3.30-4"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.3.39"}]}],"versions":["5.0.0.RELEASE","5.0.1.RELEASE","5.0.10.RELEASE","5.0.11.RELEASE","5.0.12.RELEASE","5.0.13.RELEASE","5.0.14.RELEASE","5.0.15.RELEASE","5.0.16.RELEASE","5.0.17.RELEASE","5.0.18.RELEASE","5.0.19.RELEASE","5.0.2.RELEASE","5.0.20.RELEASE","5.0.3.RELEASE","5.0.4.RELEASE","5.0.5.RELEASE","5.0.6.RELEASE","5.0.7.RELEASE","5.0.8.RELEASE","5.0.9.RELEASE","5.1.0.RELEASE","5.1.1.RELEASE","5.1.10.RELEASE","5.1.11.RELEASE","5.1.12.RELEASE","5.1.13.RELEASE","5.1.14.RELEASE","5.1.15.RELEASE","5.1.16.RELEASE","5.1.17.RELEASE","5.1.18.RELEASE","5.1.19.RELEASE","5.1.2.RELEASE","5.1.20.RELEASE","5.1.3.RELEASE","5.1.4.RELEASE","5.1.5.RELEASE","5.1.6.RELEASE","5.1.7.RELEASE","5.1.8.RELEASE","5.1.9.RELEASE","5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.15.RELEASE","5.2.16.RELEASE","5.2.17.RELEASE","5.2.18.RELEASE","5.2.19.RELEASE","5.2.2.RELEASE","5.2.20.RELEASE","5.2.21.RELEASE","5.2.22.RELEASE","5.2.23.RELEASE","5.2.24.RELEASE","5.2.25.RELEASE","5.2.3.RELEASE","5.2.4.RELEASE","5.2.5.RELEASE","5.2.6.RELEASE","5.2.7.RELEASE","5.2.8.RELEASE","5.2.9.RELEASE","5.3.0","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.14","5.3.15","5.3.16","5.3.17","5.3.18","5.3.19","5.3.2","5.3.20","5.3.21","5.3.22","5.3.23","5.3.24","5.3.25","5.3.26","5.3.27","5.3.28","5.3.29","5.3.3","5.3.30","5.3.31","5.3.32","5.3.33","5.3.34","5.3.35","5.3.36","5.3.37","5.3.38","5.3.39","5.3.4","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.18.rhlw-00010"}]}],"versions":["5.0.0.RELEASE","5.0.1.RELEASE","5.0.10.RELEASE","5.0.11.RELEASE","5.0.12.RELEASE","5.0.13.RELEASE","5.0.14.RELEASE","5.0.15.RELEASE","5.0.16.RELEASE","5.0.17.RELEASE","5.0.18.RELEASE","5.0.19.RELEASE","5.0.2.RELEASE","5.0.20.RELEASE","5.0.3.RELEASE","5.0.4.RELEASE","5.0.5.RELEASE","5.0.6.RELEASE","5.0.7.RELEASE","5.0.8.RELEASE","5.0.9.RELEASE","5.1.0.RELEASE","5.1.1.RELEASE","5.1.10.RELEASE","5.1.11.RELEASE","5.1.12.RELEASE","5.1.13.RELEASE","5.1.14.RELEASE","5.1.15.RELEASE","5.1.16.RELEASE","5.1.17.RELEASE","5.1.18.RELEASE","5.1.19.RELEASE","5.1.2.RELEASE","5.1.20.RELEASE","5.1.3.RELEASE","5.1.4.RELEASE","5.1.5.RELEASE","5.1.6.RELEASE","5.1.7.RELEASE","5.1.8.RELEASE","5.1.9.RELEASE","5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.15.RELEASE","5.2.16.RELEASE","5.2.17.RELEASE","5.2.18.RELEASE","5.2.19.RELEASE","5.2.2.RELEASE","5.2.20.RELEASE","5.2.21.RELEASE","5.2.22.RELEASE","5.2.23.RELEASE","5.2.24.RELEASE","5.2.25.RELEASE","5.2.3.RELEASE","5.2.4.RELEASE","5.2.5.RELEASE","5.2.6.RELEASE","5.2.7.RELEASE","5.2.8.RELEASE","5.2.9.RELEASE","5.3.0","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.14","5.3.15","5.3.16","5.3.17","5.3.18","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9"],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.6.RELEASE-7","3.0.6.RELEASE-8","3.0.6.RELEASE-9","3.0.6.RELEASE-10","3.0.6.RELEASE-11","3.0.6.RELEASE-12","3.0.6.RELEASE-13","3.0.6.RELEASE-13ubuntu0.1~esm1","3.0.6.RELEASE-13ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.13-3","3.2.13-4","3.2.13-5","3.2.13-5ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.11-1","4.3.12-1","4.3.13-2","4.3.14-1","4.3.22-1~18.04","4.3.22-1~18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.22-4","4.3.22-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-1","4.3.30-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2","4.3.30-2ubuntu0.24.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2ubuntu1","4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]}],"products":[{"vendor":"spring","product":"spring framework"},{"vendor":"vmware","product":"spring framework"},{"vendor":"vmware","product":"spring_framework"}],"references":[{"url":"https://spring.io/security/cve-2026-41847","tags":["Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41847","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vqgp-pf68-6947"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41847","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-framework","tags":["package"]},{"url":"https://spring.io/security/cve-2024-38816","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38816","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cx7f-g6mp-7hqm","tags":["advisory"]},{"url":"https://spring.io/security/cve-2024-38819","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38819","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22735","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22737","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22741","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41839","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41842","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41844","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47892","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41847","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41847","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-41847","title":"Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL","description":"Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.\n\nAffected versions:\nSpring Framework 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T03:51:03.298Z","modified":"2026-06-09T13:33:56.075Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-35335","description":"Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.\n\nAffected versions:\nSpring Framework 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T03:51:03Z","modified":"2026-06-09T13:33:56Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:48.012898Z"}],"ghsa":[{"id":"GHSA-vqgp-pf68-6947","title":"Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL","description":"Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.\n\nAffected versions:\nSpring Framework 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T06:31:58Z","modified":"2026-07-30T18:30:14Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:40:54.767849Z"}],"nvd":[{"id":"CVE-2026-41847","description":"Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.\n\nAffected versions:\nSpring Framework 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T05:16:36.817Z","modified":"2026-07-23T08:10:00.137Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:22.73178Z"}],"osv":[{"id":"DEBIAN-CVE-2026-41847","description":"Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.  Affected versions: Spring Framework 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T05:16:36.817Z","modified":"2026-10-01T03:03:04.619752575Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-vqgp-pf68-6947","title":"Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL","description":"Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.\n\nAffected versions:\nSpring Framework 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T06:31:58Z","modified":"2026-07-30T18:56:42.32239Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"UBUNTU-CVE-2026-41847","description":"Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.","status":"published","published":"2026-06-09T05:16:00Z","modified":"2026-10-17T12:58:16.215386021Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"CLSA-2026-1785939604","title":"TuxCare security update for org.springframework (9 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 9 CVEs. Fixed in 5.3.30-tuxcare.5.","status":"published","published":"2026-08-05T14:20:04Z","modified":"2026-11-02T19:45:48.196881782Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1785954263","title":"TuxCare security update for org.springframework (9 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 9 CVEs. Fixed in 5.3.37-tuxcare.9.","status":"published","published":"2026-08-05T18:24:23Z","modified":"2026-11-02T19:45:51.310841314Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1785957662","title":"TuxCare security update for org.springframework (7 CVEs)","description":"TuxCare rebuilt 4 org.springframework packages to address 7 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.7.","status":"published","published":"2026-08-05T19:21:02Z","modified":"2026-11-02T19:45:50.037606233Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1785969383","title":"TuxCare security update for org.springframework (4 CVEs)","description":"TuxCare rebuilt 2 org.springframework packages to address 4 CVEs. Fixed in 5.3.39-tuxcare.18.","status":"published","published":"2026-08-05T22:36:23Z","modified":"2026-10-30T07:30:29.012170338Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786339580","title":"TuxCare security update for org.springframework (4 CVEs)","description":"TuxCare rebuilt 2 org.springframework packages to address 4 CVEs. Fixed in 5.3.24-tuxcare.5.","status":"published","published":"2026-08-10T05:26:20Z","modified":"2026-10-30T07:30:22.753190041Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786552823","title":"TuxCare security update for org.springframework (10 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 10 CVEs. Fixed in 5.3.7-tuxcare.5.","status":"published","published":"2026-08-12T16:40:23Z","modified":"2026-11-02T19:45:53.423016803Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1786609560","title":"TuxCare security update for org.grails (18 CVEs)","description":"TuxCare rebuilt 33 org.grails packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1.","status":"withdrawn","published":"2026-08-13T08:26:00Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787246263","title":"TuxCare security update for org.springframework (7 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 7 CVEs. Fixed in 5.3.29-tuxcare.6.","status":"published","published":"2026-08-20T17:17:43Z","modified":"2026-11-02T19:45:56.429413485Z","updated_at":"2026-11-02T20:29:50.522328Z"},{"id":"CLSA-2026-1787317970","title":"TuxCare security update for org.springframework (5 CVEs)","description":"TuxCare rebuilt 3 org.springframework packages to address 5 CVEs. Fixed in 5.3.31-tuxcare.11.","status":"published","published":"2026-08-21T13:12:50Z","modified":"2026-11-02T19:45:57.917487636Z","updated_at":"2026-11-02T20:29:49.757752Z"},{"id":"CLSA-2026-1788372470","title":"TuxCare security update for org.springframework (21 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 21 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.4.","status":"published","published":"2026-09-02T18:07:50Z","modified":"2026-11-02T19:46:04.664553118Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1789427454","title":"TuxCare security update for org.springframework (18 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1.","status":"published","published":"2026-09-14T23:10:54Z","modified":"2026-11-02T19:46:16.037836811Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1790070671","title":"TuxCare security update for org.springframework (32 CVEs)","description":"TuxCare rebuilt 11 org.springframework packages to address 32 CVEs. Fixed in 5.3.33-tuxcare.1.","status":"published","published":"2026-09-22T09:51:11Z","modified":"2026-11-02T19:46:19.652652051Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1790234279","title":"TuxCare security update for org.springframework (27 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 27 CVEs. Fixed in 5.2.17.RELEASE-tuxcare.1.","status":"published","published":"2026-09-24T07:17:59Z","modified":"2026-11-02T19:46:21.76882388Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1793615948","title":"TuxCare security update for org.springframework (17 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 17 CVEs. Fixed in 5.2.7.RELEASE-tuxcare.3.","status":"published","published":"2026-11-02T11:39:09Z","modified":"2026-11-02T19:46:33.374523015Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793616969","title":"TuxCare security update for org.springframework (16 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 16 CVEs. Fixed in 5.2.9.RELEASE-tuxcare.2.","status":"published","published":"2026-11-02T11:56:10Z","modified":"2026-11-02T19:46:33.125808392Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793620971","title":"TuxCare security update for org.springframework (13 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 13 CVEs. Fixed in 5.2.10.RELEASE-tuxcare.3.","status":"published","published":"2026-11-02T13:02:51Z","modified":"2026-11-02T19:46:33.689179074Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793630574","title":"TuxCare security update for org.springframework (10 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 10 CVEs. Fixed in 5.3.23-tuxcare.4.","status":"published","published":"2026-11-02T15:42:54Z","modified":"2026-11-02T19:46:33.689138425Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793632081","title":"TuxCare security update for org.springframework (7 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 7 CVEs. Fixed in 5.3.13-tuxcare.5.","status":"published","published":"2026-11-02T16:08:01Z","modified":"2026-11-02T19:46:33.678763009Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793638642","title":"TuxCare security update for org.springframework (3 CVEs)","description":"TuxCare rebuilt 4 org.springframework packages to address 3 CVEs. Fixed in 5.2.25.RELEASE-tuxcare.4.","status":"published","published":"2026-11-02T17:57:23Z","modified":"2026-11-02T19:46:33.670346632Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793881978","title":"TuxCare security update for org.springframework (8 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 8 CVEs. Fixed in 5.3.20-tuxcare.4.","status":"published","published":"2026-11-05T13:32:59Z","modified":"2026-11-06T13:15:04.87153289Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"CLSA-2026-1793883499","title":"TuxCare security update for org.springframework (18 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 18 CVEs. Fixed in 5.2.8.RELEASE-tuxcare.3.","status":"published","published":"2026-11-05T13:58:20Z","modified":"2026-11-06T13:15:13.169324833Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793884148","title":"TuxCare security update for org.springframework (8 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 8 CVEs. Fixed in 5.3.3-tuxcare.4.","status":"published","published":"2026-11-05T14:09:09Z","modified":"2026-11-06T13:15:21.610344433Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793884738","title":"TuxCare security update for org.springframework (14 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 14 CVEs. Fixed in 5.3.5-tuxcare.3.","status":"published","published":"2026-11-05T14:18:59Z","modified":"2026-11-06T13:15:21.600459691Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793885497","title":"TuxCare security update for org.springframework (13 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 13 CVEs. Fixed in 5.2.11.RELEASE-tuxcare.4.","status":"published","published":"2026-11-05T14:31:38Z","modified":"2026-11-06T13:15:20.810473169Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1794157893","title":"TuxCare security update for org.springframework (16 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 16 CVEs. Fixed in 5.3.15-tuxcare.3.","status":"published","published":"2026-11-08T18:11:34Z","modified":"2026-11-08T19:30:02.435304162Z","updated_at":"2026-11-08T19:39:23.584635Z"},{"id":"RHLW-2026-8ef16ddaa2e22182","title":"Lightwell Security Advisory: spring-webflux 5.3.18.rhlw-00010","description":"Red Hat Lightwell has released org.springframework:spring-webflux 5.3.18.rhlw-00010 with backported fixes for CVE-2024-38816, CVE-2024-38819, CVE-2026-22735, CVE-2026-22737, CVE-2026-22740, CVE-2026-22741, CVE-2026-22745, CVE-2026-41839, CVE-2026-41840, CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41847, CVE-2026-41853, and CVE-2026-47892.\n\nCVE-2024-38816: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n\nSpecifically, an application is vulnerable when both of the following are true:\n\n  *  the web application uses RouterFunctions to serve static resources\n  *  resource handling is explicitly configured with a FileSystemResource location\n\n\nHowever, malicious requests are blocked and rejected when any of the following is true:\n\n  *  the  Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use\n  *  the application runs on Tomcat or Jetty\n\nCVE-2024-38819: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n\nThis patched artifact is a drop-in replacement for org.springframework:spring-webflux 5.3.18 from Maven Central.","status":"published","published":"2026-10-12T16:59:51Z","modified":"2026-10-27T04:00:12.251420115Z","updated_at":"2026-11-02T15:52:58.636919Z"}]}}