Security Bypass in Spring Framework Due to Kotlin Router DSL
CVE-2026-41847

4.8MEDIUM

Key Information:

Vendor

Spring

Status
Spring Framework
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41847?

A security bypass vulnerability exists in Spring WebFlux applications when utilizing the Kotlin Router DSL. This flaw may allow unauthorized access or manipulation when the applications are improperly configured. Developers are advised to review their implementation to protect against potential security breaches. For more details and mitigation strategies, visit the official Spring security page.

Affected Version(s)

Spring Framework 5.3.0 < 5.3.49

References

https://spring.io/security/cve-2026-41847

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.