Spring Web Flow 2.4.6 was released earlier today containing a security fix. Applications that use explicit data bindings through the <binder> element in flow definitions are not affected. Those that do rely on default bindings should upgrade as soon as possible.