Vulnerability GHSA-4hfh-6x8g-gwpp
Medium Risk
MEDIUM RISK
CVSS Score: 4.2
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 months ago
June 09, 2026 at 06:31 AM UTC
Spring Framework Escalation via Session Fixation in WebFlux
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8
Summary
Spring Framework Escalation via Session Fixation in WebFlux
Details
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8 GHSA-cjpg-rgq5-fr37
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8 GHSA-cjpg-rgq5-fr37
Medium Risk
3 months ago
Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40 GHSA-vqgp-pf68-6947
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40 GHSA-vqgp-pf68-6947
Medium Risk
3 months ago
Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8 GHSA-72pg-x5f8-j25j
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8 GHSA-72pg-x5f8-j25j
Medium Risk
3 months ago
Spring Framework Denial of Service via Multipart Requests in WebFlux
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8 GHSA-83f7-v6px-pp3h
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8 GHSA-83f7-v6px-pp3h
Medium Risk
3 months ago
Spring Framework Open Redirect in Spring MVC and WebFlux
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8 GHSA-h3qp-gqrc-q736
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8 GHSA-h3qp-gqrc-q736
Impacted packages
Timeline
Published
3 months ago
June 09, 2026 at 06:31 AM UTC
Fixed (7.0.8)
Unknown
Unknown
Fixed (6.2.19)
Unknown
Unknown
Last Modified
18 days ago
September 10, 2026 at 03:50 AM UTC