Skip to content
OpenAdvisories

Package · Maven

org.springframework.webflow:spring-webflow

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 4.8
    CVE-2026-40986

    Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML

    Spring Web Flow's JavaScript RemotingHandler renders the body of an error response as HTML even when the response is not "text/html", which can result in a scripting attack in the user's browser if the error response from the server contains error details wit…

    Spring Spring Web Flow org.springframework.webflow:spring-webflow Maven
  • Medium 6.4
    CVE-2026-40985

    Data Binding Vulnerability in Spring Web Flow with Unified EL Parser

    Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.

    Spring Spring Web Flow org.springframework.webflow:spring-webflow Maven
  • Medium 5.9
    CVE-2017-8039

    Insecure Default Initialization of Resource in Pivotal Spring Web Flow

    An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expression…

    org.springframework.webflow:spring-webflow Maven
  • Medium 5.9
    CVE-2017-4971 Public exploit EPSS 15%

    Insecure Default Initialization of Resource in Pivotal Spring Web Flow

    An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expression…

    org.springframework.webflow:spring-webflow Maven