CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-40986

Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details with input reflected from an attacker. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 11.1%

CVSS Severity

CVSS v3 Score 4.8

References

https://spring.io/security/cve-2026-40986

Products affected by CVE-2026-40986

Broadcom » Spring Web Flow » Version: 1.0.1

cpe:2.3:a:broadcom:spring_web_flow:1.0.1
Broadcom » Spring Web Flow » Version: 1.0.2

cpe:2.3:a:broadcom:spring_web_flow:1.0.2
Broadcom » Spring Web Flow » Version: 1.0.3

cpe:2.3:a:broadcom:spring_web_flow:1.0.3
Broadcom » Spring Web Flow » Version: 1.0.4

cpe:2.3:a:broadcom:spring_web_flow:1.0.4
Broadcom » Spring Web Flow » Version: 1.0.5

cpe:2.3:a:broadcom:spring_web_flow:1.0.5
Broadcom » Spring Web Flow » Version: 2.0

cpe:2.3:a:broadcom:spring_web_flow:2.0
Broadcom » Spring Web Flow » Version: 2.0.0

cpe:2.3:a:broadcom:spring_web_flow:2.0.0
Broadcom » Spring Web Flow » Version: 2.0.1

cpe:2.3:a:broadcom:spring_web_flow:2.0.1
Broadcom » Spring Web Flow » Version: 2.0.2

cpe:2.3:a:broadcom:spring_web_flow:2.0.2
Broadcom » Spring Web Flow » Version: 2.0.3

cpe:2.3:a:broadcom:spring_web_flow:2.0.3
Broadcom » Spring Web Flow » Version: 2.0.4

cpe:2.3:a:broadcom:spring_web_flow:2.0.4
Broadcom » Spring Web Flow » Version: 2.0.5

cpe:2.3:a:broadcom:spring_web_flow:2.0.5
Broadcom » Spring Web Flow » Version: 2.0.6

cpe:2.3:a:broadcom:spring_web_flow:2.0.6
Broadcom » Spring Web Flow » Version: 2.0.7

cpe:2.3:a:broadcom:spring_web_flow:2.0.7
Broadcom » Spring Web Flow » Version: 2.0.8

cpe:2.3:a:broadcom:spring_web_flow:2.0.8
Broadcom » Spring Web Flow » Version: 2.0.9

cpe:2.3:a:broadcom:spring_web_flow:2.0.9
Broadcom » Spring Web Flow » Version: 2.1.0

cpe:2.3:a:broadcom:spring_web_flow:2.1.0
Broadcom » Spring Web Flow » Version: 2.1.1

cpe:2.3:a:broadcom:spring_web_flow:2.1.1
Broadcom » Spring Web Flow » Version: 2.2.0

cpe:2.3:a:broadcom:spring_web_flow:2.2.0
Broadcom » Spring Web Flow » Version: 2.2.1

cpe:2.3:a:broadcom:spring_web_flow:2.2.1
Broadcom » Spring Web Flow » Version: 2.3.0

cpe:2.3:a:broadcom:spring_web_flow:2.3.0
Broadcom » Spring Web Flow » Version: 2.3.1

cpe:2.3:a:broadcom:spring_web_flow:2.3.1
Broadcom » Spring Web Flow » Version: 2.3.3

cpe:2.3:a:broadcom:spring_web_flow:2.3.3
Broadcom » Spring Web Flow » Version: 2.3.4

cpe:2.3:a:broadcom:spring_web_flow:2.3.4
Broadcom » Spring Web Flow » Version: 2.4.0

cpe:2.3:a:broadcom:spring_web_flow:2.4.0
Broadcom » Spring Web Flow » Version: 2.4.1

cpe:2.3:a:broadcom:spring_web_flow:2.4.1
Broadcom » Spring Web Flow » Version: 2.4.2

cpe:2.3:a:broadcom:spring_web_flow:2.4.2
Broadcom » Spring Web Flow » Version: 2.4.4

cpe:2.3:a:broadcom:spring_web_flow:2.4.4
Broadcom » Spring Web Flow » Version: 2.4.5

cpe:2.3:a:broadcom:spring_web_flow:2.4.5
Broadcom » Spring Web Flow » Version: 2.4.6

cpe:2.3:a:broadcom:spring_web_flow:2.4.6
Broadcom » Spring Web Flow » Version: 2.4.7

cpe:2.3:a:broadcom:spring_web_flow:2.4.7
Broadcom » Spring Web Flow » Version: 2.4.8

cpe:2.3:a:broadcom:spring_web_flow:2.4.8
Broadcom » Spring Web Flow » Version: 2.5.0

cpe:2.3:a:broadcom:spring_web_flow:2.5.0
Broadcom » Spring Web Flow » Version: 2.5.1

cpe:2.3:a:broadcom:spring_web_flow:2.5.1
Broadcom » Spring Web Flow » Version: 3.0.0

cpe:2.3:a:broadcom:spring_web_flow:3.0.0
Broadcom » Spring Web Flow » Version: 3.0.1

cpe:2.3:a:broadcom:spring_web_flow:3.0.1
Broadcom » Spring Web Flow » Version: 4.0.0

cpe:2.3:a:broadcom:spring_web_flow:4.0.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-40986

Products

Pricing

Contact Us