CVE-2026-40986
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Vulnerability in Spring Web Flow where the JavaScript RemotingHandler renders the error response body as HTML even when the response is not 'text/html'. This can lead to a scripting attack in the user's browser if the error response contains attacker-reflected data. Affects versions 4.0.0, 3.0.0-3.0.1, 2.5.0-2.5.1.
Risk Assessment
An attacker can inject malicious scripts that execute in the user's browser if the server returns an error with attacker-reflected data, potentially leading to data theft or session hijacking.
Recommendation
Update Spring Web Flow to a patched version or apply temporary mitigations such as setting appropriate Content-Type headers.
Other vulnerabilities in Spring Web Flow
See all- CVE-2017-4971Medium
An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property (disabled by default) can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.
- CVE-2026-40985Medium
Applications that configure WebFlowELExpressionParser are vulnerable to malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0, 3.0.0-3.0.1, and 2.5.0-2.5.1.
- CVE-2017-8039Medium
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property (disabled by default) can be vulnerable to malicious EL expressions in view states that process form submissions without explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.
Original NVD description (English source)
Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.