What’s Vulnerable › Products

Spring Web Flow vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your Spring Web Flow version is affected

Latest Spring Web Flow vulnerabilities

• CVE-2026-40986 — Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML (CVSS 4.8)
• CVE-2026-40985 — Data Binding Vulnerability in Spring Web Flow with Unified EL Parser (CVSS 6.4)
• CVE-2017-8039 — (CVSS 5.9)
• CVE-2017-4971 — (CVSS 5.9)