GHSA-4hfh-6x8g-gwpp CVE-2026-41839
Spring Framework Escalation via Session Fixation in WebFlux
- Severity
- 4.2 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.21%
- Chance of exploitation in the next 30 days. Higher than 11.59% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-384 Session Fixation
- Fix
7.0.8- Upgrade org.springframework:spring-webflux to this version or later
Description
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.springframework:spring-webflux | >= 7.0.0, < 7.0.8 |
7.0.8 |
| org.springframework:spring-webflux | >= 6.2.0, < 6.2.19 |
6.2.19 |
| org.springframework:spring-webflux | >= 6.1.0, <= 6.1.21 |
No fix yet |
| org.springframework:spring-webflux | <= 5.3.39 |
No fix yet |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.springframework:spring-webflux Maven → 7.0.8
- maven
<dependency><groupId>org.springframework</groupId><artifactId>spring-webflux</artifactId><version>7.0.8</version></dependency>- gradle
implementation("org.springframework:spring-webflux:7.0.8")
Severity breakdown
CVSS 3.1 4.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
How to prevent it
- Architecture and Design: Invalidate any existing session identifiers prior to authorizing a new user session.
- Architecture and Design: For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.
- Operation: Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
References
Advisories
Packages
Other links
- github.com/spring-projects/spring-framework/issues/36742
- github.com/spring-projects/spring-framework/issues/36743
- github.com/spring-projects/spring-framework/commit/b8ddd2c690fe3f00bb5e3d9f913a…
- github.com/spring-projects/spring-framework/commit/d72da90d3a562632e2b565113813…
- github.com/spring-projects/spring-framework/releases/tag/v6.2.19
- github.com/spring-projects/spring-framework/releases/tag/v7.0.8
- spring.io/security/cve-2026-41839
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework | Critical Known exploited | Also affects org.springframework:spring-webflux |
| GHSA-9qf2-26p9-2q2q Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints | Critical | Also affects org.springframework:spring-webflux |
| GHSA-j9f9-w8pj-32f8 Spring Framework Server Sent Event stream corruption while rendering fragments | Critical | Also affects org.springframework:spring-webflux |
| GHSA-cjpg-rgq5-fr37 Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux | Medium | Also affects org.springframework:spring-webflux |
| GHSA-vqgp-pf68-6947 Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL | Medium | Also affects org.springframework:spring-webflux |
| GHSA-h3qp-gqrc-q736 Spring Framework Open Redirect in Spring MVC and WebFlux | Medium | Also affects org.springframework:spring-webflux |
| GHSA-72pg-x5f8-j25j Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux | Medium | Also affects org.springframework:spring-webflux |
| GHSA-x23c-287f-qqv5 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux | High | Also affects org.springframework:spring-webflux |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor