Package Health/org.springframework:spring-webflux

spring-webflux

Spring WebFlux

Latest 7.1.0-M2org.springframework

Maven

91%

Total Score

healthy

Healthy package backed by active development, frequent releases, and broad project maintenance.

Are you affected? Scan for Free

Health Score Breakdown

Version stability

This is a prerelease milestone (7.1.0-M2), so APIs and behavior may still change even though the major line is established.

Workflow audit

All 14 workflows were analyzed with no untrusted checkouts or script-injection findings; six of 24 action references are unpinned, a limited hygiene gap, and the template-injection findings have no corroborating dangerous trigger or sink.

Vulnerabilities

Title	Versions	Severity
CVE-2026-47890 org.springframework:spring-webflux is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in versions 6.2.0 - 6.2.19 and 7.0.0 - 7.0.8.	6.2.0 - 6.2.197.0.0 - 7.0.8	Critical
AIKIDO-2026-865056 spring-webflux is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 7.0.8.	0.0.1 - 7.0.8	Medium
AIKIDO-2026-19545 spring-webflux is vulnerable to Information Disclosure in versions 0.0.1 - 7.0.8.	0.0.1 - 7.0.8	Low
AIKIDO-2026-699706 spring-webflux is vulnerable to Origin Validation Error in versions 5.2.5 - 7.0.8.	5.2.5 - 7.0.8	Medium
AIKIDO-2026-575580 spring-webflux is vulnerable to Sensitive Cookie with Improper SameSite Attribute in versions 6.2.0 - 7.0.8.	6.2.0 - 7.0.8	Medium

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
org.springframework:spring-beans Version 7.1.0-M2	—	—
org.springframework:spring-core Version 7.1.0-M2	—	—
org.springframework:spring-web Version 7.1.0-M2	—	—
io.projectreactor:reactor-core Version 3.8.7	—	—