Broadcom Spring Web Flow
4 CVEs affecting Broadcom Spring Web Flow. Latest disclosed: 2026-06-11. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40985 | Medium | 6.4 | 2026-06-11 | Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4… |
CVE-2017-8039 | Medium | 5.9 | 2017-11-27 | An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding prope… |
CVE-2017-4971 | Medium | 5.9 | 2017-06-13 | An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding prope… |
CVE-2026-40986 | Medium | 4.8 | 2026-06-11 | Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scr… |