Spring WebFlux Kotlin Router DSL Security Bypass (CVE-2026-41847)

Vulnerability Overview CVE ID: CVE-2026-41847 Publication Date: June 8, 2026 Description: A security bypass vulnerability may exist in Spring WebFlux applications when using the Kotlin Router DSL. Specifically, applications may be vulnerable if they meet the following conditions: - The application uses Spring WebFlux. - The application uses Kotlin Router DSL. - The application employs a filter that passes or replaces the (e.g., via ) to the next handler function to apply security-related modifications. - When all the above conditions are met, any security-related modifications applied to the are silently discarded. Downstream handler functions receive the original, unmodified request, causing the security enhancements to be ineffective. Scope of Impact Affected Products and Versions: - Spring Framework: 5.3.0 – 5.3.48 - End-of-life versions are also affected. Remediation Mitigation Measures: - Affected versions should be upgraded to the corresponding patched version. - The specific patched version is 5.3.49, available through commercial channels. - No further mitigation steps are required. Additional Information Credit: This issue was discovered internally. References: - NVD Vulnerability Metrics Calculator History: - 2026-06-08: Initial vulnerability report published. Summary This vulnerability involves a security bypass issue in Spring WebFlux applications when using Kotlin Router DSL, affecting versions 5.3.0 through 5.3.48. Users are advised to upgrade to version 5.3.49 to remediate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Spring WebFlux Kotlin Router DSL Security Bypass (CVE-2026-41847)