CVE-2026-41847: VMware Spring Framework

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.

Affected products

• VMware Spring Framework: from 5.3.0, before 5.3.49 (fixed in 5.3.49)

Published 2026-06-09. Last modified 2026-07-23.