CVE-2026-41847

Medium · 4.8

CVSS

4.8

EPSS

0.3%

Published

Jun 9, 2026

CISA due date

—

The record

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48.

Affected packages

Ecosystem	Package	Introduced	Fixed