Detection Guidance

This vulnerability involves an attacker crafting a link that causes a 302 redirect to an arbitrary external host using the "redirect:" prefix in affected Spring MVC or Spring WebFlux applications.

To detect this vulnerability on your system or network, you can monitor HTTP responses for unexpected 302 redirects that include the "redirect:" prefix pointing to external hosts.

For example, you can use tools like curl or wget to test endpoints that map to "/**" without an explicit view name and observe if a crafted URL triggers a 302 redirect to an external site.

• curl -I "http://your-application/path?redirect=http://malicious.example.com"
• Observe if the response headers include a Location field with a redirect to an external host.

Additionally, network monitoring tools or web application firewalls can be configured to alert on 302 redirects to external domains originating from your application.

Upgrading to the fixed versions of Spring Framework is the recommended mitigation.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-41844 is a security vulnerability in the Spring Framework affecting Spring MVC and Spring WebFlux applications.

The issue occurs when an application configures a mapping for "/**" without explicitly specifying the view name, allowing an attacker to craft a malicious link that causes a 302 redirect to an arbitrary external host using the "redirect:" prefix.

In Spring MVC applications with similar conditions, an attacker can also perform an internal redirect using the "forward:" prefix.

Affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to craft links that redirect users to arbitrary external hosts via a 302 redirect.

Such open redirect attacks can be used for phishing, redirecting users to malicious sites, or bypassing security controls.

In Spring MVC applications, attackers may also perform internal redirects, potentially leading to further exploitation.

The overall impact includes loss of user trust, potential exposure to malicious content, and indirect compromise of application security.

Useful 0 Not Useful 0

Mitigation Strategies

The primary and recommended mitigation step is to upgrade the Spring Framework to a fixed version.

• Upgrade to Spring Framework 7.0.8 (OSS) or 7.0.7.1 (Commercial) for 7.0.x versions.
• Upgrade to 6.2.19 (OSS) or 6.2.18.1 (Commercial) for 6.2.x versions.
• Upgrade to 6.1.28 (Commercial) for 6.1.x versions.
• Upgrade to 5.3.49 (Commercial) for 5.3.x versions.

No additional mitigation steps are required beyond upgrading.

Useful 0 Not Useful 0