Spring Framework 6.1.x Release Notes

Bug Fixes

• Predictable WebSocket session ID generation in spring-websocket (CVE-2026-41838).
• Session fixation race in WebFlux InMemoryWebSession (CVE-2026-41839).
• Memory leak in WebFlux multipart PartGenerator enabling denial of service (CVE-2026-41840).
• Cache collisions in CachingResourceResolver could expose protected static resources (CVE-2026-41841).
• Denial of service via slow versioned static resource resolution (CVE-2026-41842).
• Path traversal in versioned static resource resolution (CVE-2026-41843).
• Open redirect via redirect: and forward: prefixes in default view name translation (CVE-2026-41844).
• Incorrect escaping in JavaScriptUtils#javaScriptEscape enabling cross-site scripting (CVE-2026-41845).
• Cross-site scripting via unescaped cssClass, cssErrorClass, and cssStyle attributes in JSP form tags (CVE-2026-41846).
• Regular expression denial of service (ReDoS) in AntPathMatcher (CVE-2026-41848).
• Algorithmic denial of service in Spring Expression Language (SpEL); adds a configurable maximum-operations limit (CVE-2026-41850).
• Unbounded SpEL pattern cache growth leading to memory exhaustion (CVE-2026-41851).
• SpEL permitted zero-argument method invocation in restricted evaluation contexts (CVE-2026-41852).
• Multipart request smuggling in Spring MVC and WebFlux (CVE-2026-41853).
• Arbitrary class instantiation in the JMS MappingJackson2MessageConverter; adds a trusted-packages API to restrict deserialization (CVE-2026-41855).

Bug Fixes

• DoS with Multipart Temp Files in WebFlux (CVE-2026-22740)
• Static resource cache poisoning in Spring MVC and WebFlux (CVE-2026-22741)
• Denial of service in static resource handling on Windows platforms (CVE-2026-22745)

Bug Fixes

• SSE content spoofing via unvalidated id and event field values in SseEmitter and ServerSentEvent (CVE-2026-22735).
• Path traversal via unvalidated template location in ScriptTemplateView (CVE-2026-22737).

Bug Fixes

• This patches the Spring Framework STOMP over websocket CSRF vulnerability (CVE-2025-41254).

Bug Fixes

• This patches the Spring Framework annotation detection vulnerability (CVE-2025-41249).

Bug Fixes

• Fixed a "Path Traversal Vulnerability" occurring in Spring web MVC applications deployed to a Servlet container that is not secured.
  • This addresses CVE-2025-41242.

Dependency Upgrades

• Aspectj 1.9.24
• AssertJ 3.27.4