CVE-2026-40986

Name of the Vulnerable Software and Affected Versions Spring Web Flow version 4.0.0 Spring Web Flow versions 3.0.0 through 3.0.1 Spring Web Flow versions 2.5.0 through 2.5.1

Description The JavaScript RemotingHandler renders the body of an error response as HTML, regardless of whether the response is set to "text/html". This behavior can lead to a scripting attack in the user's browser if the server's error response includes details that reflect input provided by an attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.