Open redirect in Spring Framework - CVE-2026-41844
Published: August 28, 2026
Vulnerability identifier: #VU146172
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41844
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect users to an arbitrary external host.
The vulnerability exists due to improper control of generation of code in Spring MVC and Spring WebFlux applications when handling requests to a configured "/**" mapping with no explicit view name. A remote attacker can craft a link using the redirect: prefix to redirect users to an arbitrary external host.
User interaction is required to open the crafted link.
Affected software
Spring Framework
How to mitigate CVE-2026-41844
Install security update from vendor's website.
Spring Framework - addressed in versions 5.3.49, 6.1.28, 6.2.18.1, 6.2.19, 7.0.7.1, 7.0.8