Session Fixation in Spring Framework - CVE-2026-41839
Published: August 28, 2026
Vulnerability identifier: #VU146171
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41839
CWE-ID: CWE-384
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and modify data associated with an authenticated user's session.
The vulnerability exists due to improper session management in the WebFlux session handling mechanism when processing requests from a compromised subdomain. A remote attacker can exchange a known session ID for that of an authenticated user to disclose sensitive information and modify data associated with an authenticated user's session.
Exploitation requires user interaction and a compromised subdomain, for example through cross-site scripting.
Affected software
Spring Framework
Db2 Developer Extension
Maximo Application Suite - Monitor Component
IBM Sterling B2B Integrator
IBM Sterling File Gateway
Db2 Developer Extension
Maximo Application Suite - Monitor Component
IBM Sterling B2B Integrator
IBM Sterling File Gateway
How to mitigate CVE-2026-41839
Install security update from vendor's website.
Spring Framework - addressed in versions 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8
Db2 Developer Extension - update to 1.2.0
IBM Sterling B2B Integrator - addressed in versions 6.2.1.2.1, 6.2.2.1.1
IBM Sterling File Gateway - addressed in versions 6.2.1.2.1, 6.2.2.1.1
Maximo Application Suite - Monitor Component - addressed in versions 9.0.25, 9.1.15, 9.2.4
Db2 Developer Extension - update to 1.2.0
IBM Sterling B2B Integrator - addressed in versions 6.2.1.2.1, 6.2.2.1.1
IBM Sterling File Gateway - addressed in versions 6.2.1.2.1, 6.2.2.1.1
Maximo Application Suite - Monitor Component - addressed in versions 9.0.25, 9.1.15, 9.2.4