CVE-2026-41838

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.7 Spring Framework versions 6.2.0 through 6.2.18 Spring Framework versions 6.1.0 through 6.1.27 Spring Framework versions 5.3.0 through 5.3.48

Description WebSocket session IDs in the spring-websocket module are not cryptographically unpredictable. This issue may be exploited when combined with inadequate authorization rules.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.