CVE-2026-41844 Overview
CVE-2026-41844 is an open redirect vulnerability in the Spring Framework affecting both Spring MVC and Spring WebFlux applications. The flaw occurs when an application configures a catch-all mapping for /** without explicitly specifying a view name. An attacker can craft a link that triggers a 302 HTTP redirect to an arbitrary external host using the redirect: prefix. The weakness is classified as [CWE-601] URL Redirection to Untrusted Site.
Critical Impact
Attackers can leverage trusted Spring-based application domains to redirect users to attacker-controlled hosts, enabling phishing campaigns and credential theft.
Affected Products
- Spring Framework 7.0.0 through 7.0.7
- Spring Framework 6.2.0 through 6.2.18 and 6.1.0 through 6.1.27
- Spring Framework 5.3.0 through 5.3.48
Discovery Timeline
- 2026-06-09 - CVE-2026-41844 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-41844
Vulnerability Analysis
The vulnerability resides in how Spring MVC and Spring WebFlux resolve view names for wildcard route mappings. When an application registers a mapping for /** without explicitly defining a view name, Spring derives the view name from the request path. An attacker who controls the path portion of the URL can supply a value beginning with the redirect: prefix. Spring's view resolution machinery then interprets this prefix as an instruction to issue a 302 redirect, sending the client to the host specified by the attacker.
User interaction is required because the victim must click the crafted link. The attack complexity is elevated by the need for a vulnerable /** configuration without an explicit view name. Successful exploitation does not yield code execution or data theft directly but undermines the trust boundary of the hosting domain.
Root Cause
The root cause is an unvalidated propagation of request-derived input into Spring's view name resolution path. The redirect: prefix is honored regardless of whether the redirect target lies within the application's own domain. No allowlist of destination hosts is enforced when the view name is implicitly inferred from the URL.
Attack Vector
Exploitation occurs over the network. An attacker constructs a URL targeting the vulnerable application such that the path segment resolves to a redirect: view referencing an external host. The victim clicks the link, the Spring application returns HTTP 302, and the browser follows the redirect to the attacker-controlled destination. This pattern is commonly chained with phishing pages that imitate the legitimate application's login screen.
The vulnerability mechanism is described in the Spring Security CVE-2026-41844 advisory. No verified public exploit code is available at this time.
Detection Methods for CVE-2026-41844
Indicators of Compromise
- Outbound HTTP 302 responses from Spring applications whose Location header points to hosts outside the application's expected domain set.
- Web server access logs containing request paths that include the literal substring redirect: followed by an external URL.
- Spikes in click-through traffic from corporate domains to newly registered or low-reputation external hosts.
Detection Strategies
- Inspect Spring controller and router configurations for /** mappings that lack an explicit view name declaration.
- Deploy web application firewall (WAF) rules to flag requests where the path or query contains the redirect: prefix paired with an absolute URL.
- Correlate referer headers in downstream phishing reports with redirects originating from internally hosted Spring services.
Monitoring Recommendations
- Centralize and review reverse proxy and load balancer logs for anomalous 302 responses tied to Spring application endpoints.
- Alert on email security gateway events where reported phishing URLs resolve through internal Spring-hosted domains.
- Track threat intelligence feeds for phishing kits abusing the redirect: prefix pattern.
How to Mitigate CVE-2026-41844
Immediate Actions Required
- Upgrade Spring Framework to a fixed maintenance release above the affected ranges as documented in the Spring advisory.
- Audit all controller and router configurations for /** mappings and assign explicit view names where the mapping must remain.
- Add allowlist-based validation around any code path that constructs redirect targets from user-controlled input.
Patch Information
VMware/Spring has issued fixes in maintenance releases above Spring Framework 7.0.7, 6.2.18, 6.1.27, and 5.3.48. Consult the Spring Security CVE-2026-41844 advisory for the exact patched version numbers and upgrade guidance.
Workarounds
- Replace /** wildcard mappings with more specific path patterns that match only intended resources.
- Explicitly set a view name for any remaining catch-all mappings so Spring does not infer it from request input.
- Add a servlet filter or WebFilter that rejects inbound request paths containing the redirect: prefix.
# Maven dependency override example - replace with the patched version published by Spring
mvn versions:set-property -Dproperty=spring-framework.version -DnewVersion=<patched-version>
mvn dependency:tree | grep spring-web
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
