GitHub Advisoryadvisory · Maven

GHSA-vqgp-pf68-6947 Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL

MEDIUM Published 2026-06-09 Modified 2026-07-30 Official page ↗
Aliases
CVE-2026-41847
Ecosystem
Maven
Packages
org.springframework:spring-webflux
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-284
Reviewed
2026-07-30

Affected packages

• Maven org.springframework:spring-webflux: <= 5.3.39 (no fix yet)

Description

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.

Related

Alias · CVE (1)

  • CVE-2026-41847 Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References