CVE-2026-41839
Received Received - Intake
Session Fixation in Spring Framework

Publication date: 2026-06-09

Last updated on: 2026-06-09

Assigner: VMware

Description
A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-09
Last Modified
2026-06-09
Generated
2026-06-09
AI Q&A
2026-06-09
EPSS Evaluated
N/A
NVD
CVE-2026-41839
EUVD
EUVD-2026-35326
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
pivotal spring_framework From 7.0.0 (inc) to 7.0.7 (inc)
pivotal spring_framework From 6.2.0 (inc) to 6.2.18 (inc)
pivotal spring_framework From 6.1.0 (inc) to 6.1.27 (inc)
pivotal spring_framework From 5.3.0 (inc) to 5.3.48 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-41839 is a security vulnerability in the Spring Framework affecting WebFlux applications. It involves a session fixation attack where an attacker who has access to a compromised subdomain, for example through cross-site scripting (XSS), can escalate privileges by exchanging a known session ID for that of an authenticated user.

Impact Analysis

This vulnerability can allow an attacker to escalate their privileges by hijacking the session of an authenticated user. This means the attacker could gain unauthorized access to user accounts or sensitive information by exploiting a compromised subdomain to fixate a session ID.

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to upgrade the Spring Framework to the fixed versions.

  • Upgrade to 7.0.8 (OSS) or 7.0.7.1 (Commercial) for 7.0.x versions.
  • Upgrade to 6.2.19 (OSS) or 6.2.18.1 (Commercial) for 6.2.x versions.
  • Upgrade to 6.1.28 (Commercial) for 6.1.x versions.
  • Upgrade to 5.3.49 (Commercial) for 5.3.x versions.

No additional mitigation steps are required after upgrading.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41839. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart