CVE-2018-11040: Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, a...

Security readout for executives and security teams

This issue affects some Spring Framework web applications that intentionally or accidentally expose JSONP behavior. JSONP can let another website make cross-domain requests to application responses. Spring and Spring Boot did not enable the affected features by default, so urgency depends on local application configuration. Exposure is most likely in older Java web applications using Spring MVC REST controllers or MappingJackson2JsonView. Default Spring Framework and Spring Boot applications are less likely exposed unless JSONP-related components were configured. Prioritize applications on unsupported or pre-fixed Spring versions, especially internet-facing systems handling sensitive data. This is not evidenced as actively exploited, but stale Spring deployments should be remediated through normal vulnerability management. Mitigation focus: Upgrade Spring Framework to 5.0.7, 4.3.18, or a supported fixed release.; Remove or disable JSONP support where it is not explicitly required.; Review applications using MappingJackson2JsonView for unintended jsonp or callback handling..

Prepared

Jun 7, 2026, 06:24 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.