CVE-2026-47892 — Spring Framework Header Predicate Bypass in...

CRITICAL

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

Published August 27, 2026Updated October 7, 2026Source: osv

Summary

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE

Advisory Timeline

First published August 27, 2026 (46 days ago).
Last revised October 7, 2026 — 41 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.springframework:spring-webflux to 7.0.9 or later

<!-- Update pom.xml dependency version to 7.0.9 for org.springframework:spring-webflux -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (6)

Affects 1 ecosystem: maven (1).

Package	Ecosystem	Affected	Fixed In
org.springframework:spring-webflux	maven	6.0.0, 6.0.1, 6.0.10, 6.0.11 (+20 more)	Range-based data available
org.springframework:spring-webflux	maven	5.2.10.RELEASE, 5.2.11.RELEASE, 5.2.12.RELEASE, 5.2.13.RELEASE (+17 more)	Range-based data available
org.springframework:spring-webflux	maven	6.1.0, 6.1.1, 6.1.10, 6.1.11 (+18 more)	Range-based data available
org.springframework:spring-webflux	maven	7.0.0, 7.0.1, 7.0.2, 7.0.3 (+5 more)	7.0.9
org.springframework:spring-webflux	maven	6.2.0, 6.2.1, 6.2.10, 6.2.11 (+16 more)	Range-based data available
org.springframework:spring-webflux	maven	5.3.0, 5.3.1, 5.3.10, 5.3.11 (+36 more)	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-863
Incorrect AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-47892?: Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-47892?: CVE-2026-47892 affects org.springframework:spring-webflux. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-47892 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-9qf2-26p9-2q2q

Related CVEs

CVE-2022-22965
CRITICAL
Remote Code Execution in Spring Framework
CVE-2019-3773
CRITICAL
Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
CVE-2025-41232
CRITICAL
Spring Security authorization bypass for method security annotations on private methods
CVE-2022-22978
CRITICAL
Authorization bypass in Spring Security
CVE-2026-47890
CRITICAL
Spring Framework Server Sent Event stream corruption while rendering fragments
CVE-2026-47835
HIGH
Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
CVE-2026-41712
HIGH
Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
CVE-2026-41842
HIGH
Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies