CVE-2026-41853: spring spring framework HTTP Request/Response Smuggling
CVSS: 5.3v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-41853DEBIAN-CVE-2026-41853CGA-pjwj-7fmr-cvrwCGA-q5vv-pqgf-h989CGA-3mq6-f455-jhprCGA-3pvm-wf5r-mrrrCGA-4g99-x2q6-2x95CGA-5583-6wx7-m7mqCGA-5gp5-g8px-qqg6CGA-6g7f-94gm-4fhhCGA-6pvq-jmg2-fxhcCGA-767j-rrhx-4gqjCGA-8vx8-qjvm-g778CGA-f854-89jw-wpm6CGA-fqp3-x8c5-r357CGA-gjgj-cwr8-q375CGA-gvh9-v3q9-pqhqCGA-gx3f-fhgh-mm6qCGA-h8r4-vhw9-4cr2CGA-hcj7-2mfr-vcm5CGA-j3x6-w92m-ccx3CGA-j5mw-wx2f-wfcqCGA-m632-p439-wjj5CGA-m7r4-733q-c7w5CGA-p84v-8gcp-qhv8CGA-pc63-f8mw-6hpxCGA-pf57-7chr-fjw8CGA-pmh4-r986-ppqgGHSA-cjpg-rgq5-fr37CGA-qxjf-24wc-8rgwCGA-r2q7-79g5-56rmCGA-rf7p-xcrm-pmc9CGA-v792-877f-x6wrCGA-v79h-v3h9-wffwCGA-vxhh-fcc8-qvmgCGA-w87m-4874-7w9jCGA-wrm9-24gx-32c3CGA-xf48-7xxw-33m2
Published 09-06-2026Last modified 27-06-2026
Vulnerability summary
CVE-2026-41853 is a medium (CVSS 5.3) HTTP Request/Response Smuggling vulnerability in spring spring framework. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.3% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.31%
0%100%
Low · +0.12 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 09-06-2026PublishedVulnerability first disclosed.
- 27-06-2026Last modifiedVulnerability information updated.
Description
Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
+0.12 pp
From 0.19% on 18-09-2026
18-09-202618-10-2026
EPSS score0.31%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard16 products
- apache-activemq-5.19All versions (No fix recorded)
- apache-activemq-6.2< 6.2.8-r2
- apache-activemq-fips-5.19All versions (No fix recorded)
- apache-activemq-fips-6.2< 6.2.8-r4
- apache-nifi-registry< 2.10.0-r4 | < 2.10.0-r3
Org.springframework2 products
- spring-webflux≥ 7.0.0, < 7.0.8 | ≥ 6.2.0, < 6.2.19 | ≥ 6.1.0, ≤ 6.1.21 | ≤ 5.3.39
- spring-webmvc≥ 7.0.0, < 7.0.8 | ≥ 6.2.0, < 6.2.19 | ≥ 6.1.0, ≤ 6.1.21 | ≤ 5.3.39
Debian1 product
- libspring-javaAll versions (No fix recorded)
Spring1 product
- spring framework≥ 7.0.0, < 7.0.7.1 | ≥ 6.2.0, < 6.2.18.1 | ≥ 6.1.0, < 6.1.28 | ≥ 5.3.0, < 5.3.49
Ubuntu1 product
- libspring-javaAll versions (No fix recorded)
Vmware1 product
- spring_framework≥ 5.3.0, < 5.3.49 | ≥ 6.1.0, < 6.1.28 | ≥ 6.2.0, < 6.2.18.1 | ≥ 7.0.0, < 7.0.7.1
Wolfi1 product
- apache-nifi-registry< 2.10.0-r4 | < 2.10.0-r3
7 vendors · 23 products
