Loading vulnerability…
Session Fixation Escalation in Spring Framework WebFlux
CVE-2026-41839 is a session fixation vulnerability in Spring Framework WebFlux. When an application's subdomain is compromised, for example through cross-site scripting, an attacker can exchange a known session ID for that of an authenticated user, enabling session impersonation or privilege escalation. Affected Spring Framework versions are 7.0.0–7.0.7, 6.2.0–6.2.18, 6.1.0–6.1.27, and 5.3.0–5.3.48. Unsupported versions may also be affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise an authenticated user's session, allowing unauthorized access to protected information and actions under that user's permissions. The vulnerability-specific CVSS v3.1 vector indicates low confidentiality and integrity impact and no availability impact. Spring rates the vulnerability Low severity.
If you can’t patch tonight, do this now.
Prevent or remediate subdomain compromise, including cross-site scripting, and review subdomain trust relationships and session-cookie scope to reduce exposure. These measures are defense in depth rather than a confirmed substitute for patching. Spring states that no further mitigation steps are necessary after upgrading.
Patch, then assume compromise.
Upgrade Spring Framework and its spring-webflux dependency to the appropriate fixed release: 7.0.8 or 6.2.19 for OSS users; commercial fixes include 7.0.7.1, 6.2.18.1, 6.1.28, and 5.3.49 for their respective branches. Move unsupported deployments to a supported, fixed release. For vendor-packaged applications, apply the vendor release or security update incorporating the Spring fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.