Vulnerability GHSA-h3qp-gqrc-q736
Medium Risk
MEDIUM RISK
CVSS Score: 4.2
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 months ago
June 09, 2026 at 06:31 AM UTC
Spring Framework Open Redirect in Spring MVC and WebFlux
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8
Summary
Spring Framework Open Redirect in Spring MVC and WebFlux
Details
A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
Spring Framework Cross-site Scripting via JSP Form Tags
1.0.0 - 1.0.1 GHSA-957g-f97v-vppc
1.0.0 - 1.0.1 GHSA-957g-f97v-vppc
Medium Risk
3 months ago
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
Medium Risk
3 months ago
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
Medium Risk
3 months ago
Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40 GHSA-vqgp-pf68-6947
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40 GHSA-vqgp-pf68-6947
High Risk
3 months ago
Spring Framework Cross-site Scripting via JavaScriptUtils
1.0.0 - 1.0.1 GHSA-3chg-m5w7-qfv5
1.0.0 - 1.0.1 GHSA-3chg-m5w7-qfv5
Impacted packages
Timeline
Published
3 months ago
June 09, 2026 at 06:31 AM UTC
Fixed (7.0.8)
Unknown
Unknown
Fixed (6.2.19)
Unknown
Unknown
Fixed (7.0.8)
Unknown
Unknown
Fixed (6.2.19)
Unknown
Unknown
Last Modified
18 days ago
September 10, 2026 at 03:50 AM UTC