Broadcom Spring Web Flow vulnerabilities

4 CVEs affecting Broadcom Spring Web Flow, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-40986, published 2026-06-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-4971, published 2017-06-13. Medium severity, CVSS 5.9. EPSS: 14.7% chance of exploitation in the next 30 days. An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e.,…
CVE-2017-8039, published 2017-11-27. Medium severity, CVSS 5.9. EPSS: 1% chance of exploitation in the next 30 days. An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e.,…
CVE-2026-40985, published 2026-06-11. Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days. Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through…
CVE-2026-40986, published 2026-06-11. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if…