CLSA-2026-1793102691: TuxCare security update for org.springframework (1 CVE)

Q: Which installed components should be checked for this update?

Check tuxcare/org.springframework:spring-webflux and tuxcare/org.springframework:spring-webmvc. The update covers rebuilt packages for these two components.

Q: What package version includes the fix?

The fix is included in version 5.3.9-tuxcare.3.

Q: Does the advisory identify the CVE or describe exploitation conditions?

No. The available advisory data states that one CVE is addressed, but does not identify it or provide affected configurations, exposure conditions, or mitigation guidance.

Published Oct 27, 2026

Updated

TuxCare rebuilt 2 org.springframework packages to address 1 CVE. Fixed in 5.3.9-tuxcare.3.

Affected Software

2 affected componentsFixes available

tuxcare/org.springframework:spring-webflux>=5.3.9<5.3.9-tuxcare.3

5.3.9-tuxcare.3

tuxcare/org.springframework:spring-webmvc>=5.3.9<5.3.9-tuxcare.3

5.3.9-tuxcare.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tuxcare/org.springframework:spring-webflux to a version that resolves this vulnerability.
Fixed in 5.3.9-tuxcare.3
Upgrade
Upgrade tuxcare/org.springframework:spring-webmvc to a version that resolves this vulnerability.
Fixed in 5.3.9-tuxcare.3
Upgrade
Upgrade org.springframework to a version that resolves this vulnerability.
Fixed in 5.3.9-tuxcare.3

Event History

Oct 27, 2026

Advisory Published

via OSV·12:04 PM

Data Sourced

via OSV·12:04 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-41843

Frequently Asked Questions

Which installed components should be checked for this update?

Check tuxcare/org.springframework:spring-webflux and tuxcare/org.springframework:spring-webmvc. The update covers rebuilt packages for these two components.

What package version includes the fix?

The fix is included in version 5.3.9-tuxcare.3.

Does the advisory identify the CVE or describe exploitation conditions?

No. The available advisory data states that one CVE is addressed, but does not identify it or provide affected configurations, exposure conditions, or mitigation guidance.

CLSA-2026-1793102691: TuxCare security update for org.springframework (1 CVE)

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which installed components should be checked for this update?

What package version includes the fix?

Does the advisory identify the CVE or describe exploitation conditions?

Company

Resources

Contact

Frequently Asked Questions

Which installed components should be checked for this update?

What package version includes the fix?

Does the advisory identify the CVE or describe exploitation conditions?