CVE-2026-41844

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.7 Spring Framework versions 6.2.0 through 6.2.18 Spring Framework versions 6.1.0 through 6.1.27 Spring Framework versions 5.3.0 through 5.3.48

Description A Spring MVC or Spring WebFlux application that configures a mapping for "/**" without an explicitly specified view name allows an attacker to craft a link that triggers a 302 redirect to an arbitrary external host using the redirect: prefix.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.