Spring Spring Web Flow
2 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-40986 | 4.0.0 – < 4.0.0.1 ; 3.0.0 – < 3.0.1.1 ; 2.5.0 – < 2.5.2 | Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML | MEDIUM 4.8 | 0.2 % | ||
| CVE-2026-40985 | 4.0.0 – < 4.0.0.1 ; 3.0.0 – < 3.0.1.1 ; 2.5.0 – < 2.5.2 | Data Binding Vulnerability in Spring Web Flow with Unified EL Parser | MEDIUM 6.4 | 0.2 % |