Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Spring Frameworkで深刻な脆弱性複数が修正。Spring SecurityのXSS CVE-2026-41003、Spring WSのSSRF CVE-2026-40999、XXEのCVE-2026-40998、検証バグのCVE-2026-40994。 https://securityonline.info/spring-security-vulnerabilities/
Post summary
The post announces that several severe Spring Framework vulnerabilities have been patched, providing CVE identifiers, vulnerability types, and a link to a vendor advisory.
Spring SecurityとSpring WSがXSS・SSRF・XXE・BSP検証バイパスを含む複数の脆弱性を修正(CVE-2026-41003,CVE-2026-40999)他 https://rocket-boys.co.jp/security-measures-lab/spring-security-ws-cve-2026-41003-40999/ #セキュリティ対策Lab #security #securitynews
Post summary
This post announces patches for Spring Security and Spring WS that fix multiple vulnerabilities—including XSS, SSRF, XXE, and BSP bypass—associated with CVE‑2026‑41003 and CVE‑2026‑40999.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vmware | spring_security | - | - | - |