CVE-2026-41839

Undergoing Analysis Undergoing Analysis - In Progress

Session Fixation in Spring Framework

Publication date: 2026-06-09

Last updated on: 2026-06-23

Assigner: VMware

Description

A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-23

Generated

2026-06-29

AI Q&A

2026-06-09

EPSS Evaluated

2026-06-28

NVD

CVE-2026-41839

EUVD

EUVD-2026-35326

Affected Vendors & Products

Vendor	Product	Version / Range
pivotal	spring_framework	From 7.0.0 (inc) to 7.0.7 (inc)
pivotal	spring_framework	From 6.2.0 (inc) to 6.2.18 (inc)
pivotal	spring_framework	From 6.1.0 (inc) to 6.1.27 (inc)
pivotal	spring_framework	From 5.3.0 (inc) to 5.3.48 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-384	Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

Compliance Impact

This vulnerability allows an attacker to escalate privileges by exchanging a known session ID for that of an authenticated user, potentially leading to unauthorized access to sensitive data.

Such unauthorized access could result in violations of data protection regulations like GDPR and HIPAA, which require strict controls over user authentication and data confidentiality.

Therefore, if exploited, this vulnerability may compromise compliance with these standards by exposing personal or protected health information through session fixation attacks.

Executive Summary

CVE-2026-41839 is a security vulnerability in the Spring Framework affecting WebFlux applications. It involves a session fixation attack where an attacker who has access to a compromised subdomain, for example through cross-site scripting (XSS), can escalate privileges by exchanging a known session ID for that of an authenticated user.

Impact Analysis

This vulnerability can allow an attacker to escalate their privileges by hijacking the session of an authenticated user. This means the attacker could gain unauthorized access to user accounts or sensitive information by exploiting a compromised subdomain to fixate a session ID.

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to upgrade the Spring Framework to the fixed versions.

Upgrade to 7.0.8 (OSS) or 7.0.7.1 (Commercial) for 7.0.x versions.
Upgrade to 6.2.19 (OSS) or 6.2.18.1 (Commercial) for 6.2.x versions.
Upgrade to 6.1.28 (Commercial) for 6.1.x versions.
Upgrade to 5.3.49 (Commercial) for 5.3.x versions.

No additional mitigation steps are required after upgrading.

Hi! I’m here to help you understand CVE-2026-41839. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70