CVE-2026-41003

published 2026-06-10

CVE-2026-41003: An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected…

Priority P4 32 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.

Affected versions:
Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
spring	spring_security	>= 5.7.0 < 5.7.24	5.7.24
spring	spring_security	>= 5.8.0 < 5.8.26	5.8.26
spring	spring_security	>= 6.3.0 < 6.3.17	6.3.17
spring	spring_security	>= 6.4.0 < 6.4.17	6.4.17
spring	spring_security	>= 6.5.0 < 6.5.10.2	6.5.10.2
spring	spring_security	>= 7.0.0 < 7.0.5.1	7.0.5.1
vmware	spring_security	>= 5.7.0 < 5.7.24	5.7.24
vmware	spring_security	>= 5.8.0 < 5.8.26	5.8.26
vmware	spring_security	>= 6.3.0 < 6.3.17	6.3.17
vmware	spring_security	>= 6.4.0 < 6.4.17	6.4.17
vmware	spring_security	>= 6.5.0 < 6.5.10.2	6.5.10.2
vmware	spring_security	>= 7.0.0 < 7.0.5.1	7.0.5.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79