What is the CVSS score of CVE-2026-41839?

CVE-2026-41839 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41839?

Yes, a patch is available for CVE-2026-41839. Update the affected software to the latest version immediately.

Spring Framework CVE-2026-41839

EUVD-2026-35326 MEDIUM

Session Fixation (CWE-384)

2026-06-09 vmware

GHSA-4hfh-6x8g-gwpp

XSS Java Spring Red Hat Session Fixation Spring Framework

4.2

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Red Hat

4.2 MEDIUM

qualitative

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:26 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.springframework:spring-webflux (5 direct, 1 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

AnalysisAI

Session fixation in Spring Framework's WebFlux reactive stack (versions 5.3.x through 7.0.x) enables a remote attacker to hijack an authenticated user's session by leveraging a compromised subdomain - typically via cross-site scripting - to plant a known session ID and exchange it for the victim's authenticated session post-login. The attack is classified as CWE-384 and requires both a prior subdomain compromise and user interaction, placing real-world exploitability well below the headline concern for most deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

Spring Framework's WebFlux module is the reactive, non-blocking HTTP stack built on Project Reactor, distinct from the traditional Spring MVC servlet stack. CVE-2026-41839 maps to CWE-384 (Session Fixation), a vulnerability class where an attacker pre-establishes or injects a session identifier before a user authenticates; once the user logs in, the server binds that known session ID to the now-authenticated session, giving the attacker access. The mechanism exploited here relies on subdomain cookie scope: a script executing on a compromised subdomain (e.g., assets.example.com) can write cookies scoped to the parent domain (example.com), thereby planting an attacker-controlled session ID into the victim's browser before they authenticate on the WebFlux application. The CPE string cpe:2.3:a:spring:spring_framework confirms the vulnerability spans the core Spring Framework library across four active version lines: 5.3.x, 6.1.x, 6.2.x, and 7.0.x. The Spring Framework is maintained by VMware/Broadcom and is among the most widely deployed Java application frameworks globally.

RemediationAI

The primary fix is to upgrade Spring Framework beyond the affected version ranges. Per the vendor advisory at https://spring.io/security/cve-2026-41839, applications running 7.0.0-7.0.7 should upgrade to a release above 7.0.7; those on 6.2.0-6.2.18 should upgrade beyond 6.2.18; those on 6.1.0-6.1.27 should upgrade beyond 6.1.27; and those on 5.3.0-5.3.48 should upgrade beyond 5.3.48. Exact first-fixed release numbers are not independently specified in the available intelligence - consult the vendor advisory to confirm the precise patched build for each line. As compensating controls where immediate patching is not feasible: configure session cookies with SameSite=Strict to prevent cross-site cookie injection (note: this may break legitimate cross-origin authentication flows); set the Secure flag on session cookies to prevent transmission over unencrypted channels; deploy strict Content Security Policy headers on all subdomains sharing the parent domain to reduce XSS footholds; audit all subdomains for XSS vulnerabilities and subdomain takeover exposure; and ensure the application regenerates session IDs upon authentication to invalidate pre-planted sessions. Session regeneration on login is the most direct architectural mitigation.