CVE-2026-47892
Received Received - Intake

Header Predicate Bypass in Spring Framework WebFlux Applications

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-47892
EUVD
EUVD-2026-66860

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
spring framework From 7.0.0 (inc) to 7.0.8 (inc)
spring framework From 6.2.0 (inc) to 6.2.19 (inc)
spring framework From 6.1.0 (inc) to 6.1.28 (inc)
spring framework From 6.0.0 (inc) to 6.0.30 (inc)
spring framework From 5.3.0 (inc) to 5.3.49 (inc)
spring framework From 5.2.5 (inc) to 5.2.25 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects WebFlux applications using functional endpoints deployed with DispatcherServlet. It allows bypassing header predicates in pre-flight requests, potentially enabling unauthorized access or manipulation of application behavior.

Detection Guidance

Detection requires checking if your Spring Framework version falls within the vulnerable ranges. Use commands like 'curl -I http://yourserver:port' to inspect headers or check version via 'find / -name spring-core*.jar 2>/dev/null' and inspect MANIFEST.MF for version details.

Impact Analysis

An attacker could exploit this to bypass security checks in pre-flight requests, potentially gaining unauthorized access to restricted resources or performing actions they shouldn't be able to.

Compliance Impact

The vulnerability involves a header predicate bypass in pre-flight requests for WebFlux applications using functional endpoints with DispatcherServlet. This could potentially allow unauthorized cross-origin requests, which may impact data protection measures required by GDPR and HIPAA if sensitive data is exposed or improperly accessed.

Mitigation Strategies

Upgrade to the fixed versions: 7.0.9, 7.0.8.1 (Enterprise), 6.2.20 (Enterprise), 6.1.29 (Enterprise), 6.0.31 (Enterprise), 5.3.50 (Enterprise), or 5.2.26 (Enterprise). No other mitigation is required beyond upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47892. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart