PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41844 Spring CVE debrief

A Spring MVC or Spring WebFlux application that configures a mapping for '/**' without explicitly specifying a view name is vulnerable to a 302 redirect attack via the 'redirect:' prefix. This issue affects Spring Framework versions 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.

Vendor
Spring
Product
Spring Framework
CVSS
MEDIUM 4.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-07-17
Advisory published
2026-06-09
Advisory updated
2026-07-17

Who should care

Users of affected Spring Framework versions should review and update their configurations to mitigate this vulnerability.

Technical summary

The vulnerability arises from the way Spring handles view names in mappings. When a mapping is configured for '/**' without a specified view name, an attacker can exploit this by crafting a link with the 'redirect:' prefix, potentially redirecting users to arbitrary external hosts.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update to a non-vulnerable version of Spring Framework.
  • Review and adjust application configurations for '/**' mappings to specify explicit view names.

Evidence notes

CVE-2026-41844 has a CVSS score of 4.2 and is classified as MEDIUM severity. It was published on 2026-06-09 and modified on 2026-06-11.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-41844 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-41844

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-41844 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41844

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.