Spring Framework 7.0.8 and 6.2.19 are available now. The releases address the following CVEs:

• "CVE-2026-41838: Spring Framework Predictable Session ID in WebSocket Module"
• "CVE-2026-41839: Spring Framework Escalation via Session Fixation in WebFlux"
• "CVE-2026-41840: Spring Framework Denial of Service via Multipart Requests in WebFlux"
• "CVE-2026-41841: Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
• "CVE-2026-41842: Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
• "CVE-2026-41843: Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
• "CVE-2026-41844: Spring Framework Open Redirect in Spring MVC and WebFlux"
• "CVE-2026-41845: Spring Framework Cross-site Scripting via JavaScriptUtils"
• "CVE-2026-41846: Spring Framework Cross-site Scripting via JSP Form Tags"
• "CVE-2026-41847: Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL" (commercial / 5.3.x only)
• "CVE-2026-41848: Spring Framework Denial of Service via AntPathMatcher"
• "CVE-2026-41849: Spring Framework Denial of Service via Integer Overflow in SpEL Expressions" (commercial / 5.3.x only)
• "CVE-2026-41850: Spring Framework Algorithmic Denial of Service via SpEL Expressions"
• "CVE-2026-41851: Spring Framework Denial of Service via Unbounded Cache in SpEL"
• "CVE-2026-41852: Spring Framework Arbitrary Method Invocation in SpEL Expressions"
• "CVE-2026-41853: Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
• "CVE-2026-41854: Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
• "CVE-2026-41855: Spring Framework Unsafe Deserialization via Jackson JMS Converters"

Spring Framework 6.2.19 is most probably the last OSS release of the 6.2.x generation, so please consider upgrading to 7.0.x at your earliest convenience. Commercial releases are also available.