Known vulnerabilities in Spring Web Flow
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-40986 | Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not… | 4.8 Medium | Jun 11, 2026 |
| CVE-2026-40985 | Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions | 6.4 Medium | Jun 11, 2026 |