TI-2026-30257 Aliases CVE-2026-41847 GHSA-vqgp-pf68-6947

Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL

LOW 23CWE-284Published 2026-06-09 · Updated 2026-06-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.

Summary

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00166 5th percentileScored 2026-11-07

Fix Partial Spring Framework (Spring): 5.3.49Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	Spring Framework	5.3.0 to before 5.3.49	5.3.49	Patch available	CNA
—	org.springframework:spring-webflux (Maven)	up to 5.3.39	—	No fix listed	GHSA-vqgp-pf68-6947

Spring Framework VendorVMware Affected 5.3.0 to before 5.3.49 Fixed in 5.3.49 Patch available CNA
org.springframework:spring-webflux (Maven) Vendor— Affected up to 5.3.39 Fixed in — No fix listed GHSA-vqgp-pf68-6947

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:spring_framework::::::::	5.3.0 to before 5.3.49	Vulnerable	VMware

cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions 5.3.0 to before 5.3.49 Vulnerable ·VMware

Remediation

Fix · CNA Spring Framework (Spring) Fixed in 5.3.49

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-09
Spring Framework 5.3.49
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-30259 Spring Framework Denial of Service via Integer Overflow in SpEL ExpressionsPriority LOW 32
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Fuse 7	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-41847
2026-10-03 Alias added: GHSA-vqgp-pf68-6947

References

Advisory 2

Other 1

https://github.com/spring-projects/spring-framework

TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
TI-2018-01180 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
TI-2016-09283 Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution… CVSS 3.1CRITICAL 9.8
TI-2014-00050 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8… CVSS 2.0MEDIUM 6.8

See all 82 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences