CVE-2026-41847: Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.

PriorityP428medium5.3CVSS 3.1

AVNACLPRNUINSUCNILAN

EPSS

0.17%

6.3th percentile

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
spring	spring_framework	>= 5.3.0 < 5.3.49	5.3.49
vmware	spring_framework	>= 5.3.0 < 5.3.49	5.3.49

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.