Spring Blog

Spring Web Flow 3.0.2 and 4.0.1 Available Now

Releases | Rossen Stoyanchev | June 10, 2026 | 1 min read | ...

Spring Web Flow 3.0.2 and 4.0.1 are available now. The releases fix "CVE-2026-40985: Data Binding Vulnerability in Spring Web Flow with Unified EL Parser" and "CVE-2026-40986: Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML". A commercial release is also available.

Get the Spring newsletter

Stay connected with the Spring newsletter

Subscribe

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all