{"advisories":[{"id":"GHSA-q723-847q-5g8g","source":"ghsa","title":"Spring Framework Predictable Session ID in WebSocket Module","url":"https://github.com/advisories/GHSA-q723-847q-5g8g"}],"cve":"CVE-2026-41838","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[7.0.0,7.0.8)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[6.2.0,6.2.19)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[6.1.0,6.1.28)"}},{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[5.3.0,5.3.49)"}}],"enrichment":{"confidence":100.0,"confidence_source":"matching","scores":[{"score":100.0,"source":"matching"}]},"original":{"product":"Spring Framework","source":"cna","vendor":"Spring"},"product":"spring_framework","vendor":"spring"}],"created":"2026-06-09T05:30:35.970965+00:00","updated":"2026-06-09T05:30:36.258953+00:00","vendors":["spring","spring$PRODUCT$spring_framework"]},"epss":{"score":0.00171},"mitre":{"cpes":[],"created":"2026-06-09T03:49:15.933000+00:00","description":"IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/41xxx/CVE-2026-41838.json","references":["https://spring.io/security/cve-2026-41838"],"title":"Spring Framework Predictable Session ID in WebSocket Module","updated":"2026-06-27T20:57:50.695000+00:00","vendors":[],"weaknesses":["CWE-330"]},"nvd":{"cpes":["cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*"],"created":"2026-06-09T05:16:35.723000+00:00","description":"IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-41838.json","references":["https://spring.io/security/cve-2026-41838"],"title":null,"updated":"2026-07-23T08:10:00.137000+00:00","vendors":["vmware","vmware$PRODUCT$spring_framework"],"weaknesses":["CWE-330"]},"opencve":{"changes":[{"created":"2026-06-09T04:45:00+00:00","data":[{"details":{"new":"IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.","old":null},"type":"description"},{"details":{"new":"Spring Framework Predictable Session ID in WebSocket Module","old":null},"type":"title"},{"details":{"added":["CWE-330"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://spring.io/security/cve-2026-41838"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"d10ab912-07d0-4810-88ad-2d71d76530e3"},{"created":"2026-06-09T05:45:00+00:00","data":[{"details":["spring","spring$PRODUCT$spring_framework"],"type":"first_time"},{"details":{"added":["spring","spring$PRODUCT$spring_framework"],"removed":[]},"type":"vendors"}],"id":"b60dc3cd-185a-45c8-b194-d87854637851"},{"created":"2026-06-09T14:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"63db6057-fc1c-4965-a8b8-867344dda530"},{"created":"2026-06-11T17:00:00+00:00","data":[{"details":["vmware","vmware$PRODUCT$spring_framework"],"type":"first_time"},{"details":{"added":["cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["vmware","vmware$PRODUCT$spring_framework"],"removed":[]},"type":"vendors"}],"id":"08ce4772-4d29-41d2-85b4-72077713a26c"}],"cpes":{"data":["cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2026-06-09T03:49:15.933000+00:00","provider":"mitre"},"description":{"data":"IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00171},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://spring.io/security/cve-2026-41838"],"providers":["mitre","nvd"]},"title":{"data":"Spring Framework Predictable Session ID in WebSocket Module","provider":"mitre"},"updated":{"data":"2026-06-11T16:53:41.830000+00:00","provider":"nvd"},"vendors":{"data":["spring","spring$PRODUCT$spring_framework","vmware","vmware$PRODUCT$spring_framework"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-330"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2026-06-09T03:49:15.933000+00:00","description":"IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"Spring Framework Predictable Session ID in WebSocket Module","updated":"2026-06-09T13:39:39.877000+00:00","vendors":[],"vulnrichment_repo_path":"2026/41xxx/CVE-2026-41838.json","weaknesses":[]}}