CVE-2026-41847
published 2026-06-09CVE-2026-41847: Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.17%
6.1th percentile
Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.
Affected versions:
Spring Framework 5.3.0 through 5.3.48.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_framework | >= 5.3.0 < 5.3.49 | 5.3.49 |
| vmware | spring_framework | >= 5.3.0 < 5.3.49 | 5.3.49 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL
ghsa·2026-06-09
CVE-2026-41847 [MEDIUM] CWE-284 Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL
Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL
Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.
Affected versions:
Spring Framework 5.3.0 through 5.3.48.
GHSA
Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.
ghsa_unreviewed·2026-06-09
CVE-2026-41847 [MEDIUM] CWE-284 Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.
Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.
Affected versions:
Spring Framework 5.3.0 through 5.3.48.
Red Hat
Spring Framework: Spring WebFlux applications: Security bypass when using Kotlin Router DSL
vendor_redhat·2026-06-09·CVSS 5.3
CVE-2026-41847 [MEDIUM] CWE-551 Spring Framework: Spring WebFlux applications: Security bypass when using Kotlin Router DSL
Spring Framework: Spring WebFlux applications: Security bypass when using Kotlin Router DSL
Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.
Affected versions:
Spring Framework 5.3.0 through 5.3.48.
A flaw was found in Spring WebFlux applications. This vulnerability allows for a security bypass when using the Kotlin Router DSL. An attacker could exploit this to bypass security restrictions, potentially leading to unauthorized access.
Statement: Red Hat ships Spring WebFlux in Fuse 7. The affected version is set to AFFECTED/DEFER as the CVSS score (4.8) is below the 7.0 threshold. This flaw only affects applications using the Kotlin Router DSL.
Mitigation: This vulnerability only applies when using Kotlin Router DSL. Applications using
No detection rules found.
No public exploits indexed.
2026-06-09
Published