Spring Framework v7.0.8 security fixes

{
  "id": "e4b293fcbee6c535ed5d73a295ade4d1aea5820ec9b94408e8413d1c9ccd5a94",
  "url": "https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Spring Framework v7.0.8 security fixes",
    "summary": "Spring Framework v7.0.8 fixes 16 listed CVEs.",
    "evidence": "This maintenance release fixes a high number of CVEs.",
    "products": [
      {
        "name": {
          "value": "Spring Framework",
          "evidence": "Spring Framework Predictable Session ID in WebSocket Module"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "v7.0.8",
            "evidence": "v7.0.8"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-41838",
        "evidence": "CVE-2026-41838 \"Spring Framework Predictable Session ID in WebSocket Module\""
      },
      {
        "value": "CVE-2026-41839",
        "evidence": "CVE-2026-41839 \"Spring Framework Escalation via Session Fixation in WebFlux\""
      },
      {
        "value": "CVE-2026-41840",
        "evidence": "CVE-2026-41840 \"Spring Framework Denial of Service via Multipart Requests in WebFlux\""
      },
      {
        "value": "CVE-2026-41841",
        "evidence": "CVE-2026-41841 \"Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux\""
      },
      {
        "value": "CVE-2026-41842",
        "evidence": "CVE-2026-41842 \"Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux\""
      },
      {
        "value": "CVE-2026-41843",
        "evidence": "CVE-2026-41843 \"Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux\""
      },
      {
        "value": "CVE-2026-41844",
        "evidence": "CVE-2026-41844 \"Spring Framework Open Redirect in Spring MVC and WebFlux\""
      },
      {
        "value": "CVE-2026-41845",
        "evidence": "CVE-2026-41845 \"Spring Framework Cross-site Scripting via JavaScriptUtils\""
      },
      {
        "value": "CVE-2026-41846",
        "evidence": "CVE-2026-41846 \"Spring Framework Cross-site Scripting via JSP Form Tags\""
      },
      {
        "value": "CVE-2026-41848",
        "evidence": "CVE-2026-41848 \"Spring Framework Denial of Service via AntPathMatcher\""
      },
      {
        "value": "CVE-2026-41850",
        "evidence": "CVE-2026-41850 \"Spring Framework Algorithmic Denial of Service via SpEL Expressions\""
      },
      {
        "value": "CVE-2026-41851",
        "evidence": "CVE-2026-41851 \"Spring Framework Denial of Service via Unbounded Cache in SpEL\""
      },
      {
        "value": "CVE-2026-41852",
        "evidence": "CVE-2026-41852 \"Spring Framework Arbitrary Method Invocation in SpEL Expressions\""
      },
      {
        "value": "CVE-2026-41853",
        "evidence": "CVE-2026-41853 \"Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux\""
      },
      {
        "value": "CVE-2026-41854",
        "evidence": "CVE-2026-41854 \"Spring Framework Server-Side Request Forgery via UriComponentsBuilder\""
      },
      {
        "value": "CVE-2026-41855",
        "evidence": "CVE-2026-41855 \"Spring Framework Unsafe Deserialization via Jackson JMS Converters\""
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-spring-projects-spring-framework",
  "document_id": 22688,
  "published_at": "2026-06-09T14:20:17+00:00"
}