CVE-2026-47893

Analyzed Analyzed - Analysis Complete

Information Disclosure in Spring Framework via WebSocket Exception Headers

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VMware

Description

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47893

EUVD

EUVD-2026-66861

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_framework	From 6.2.0 (inc) to 6.2.20 (exc)
vmware	spring_framework	From 6.1.0 (inc) to 6.1.29 (exc)
vmware	spring_framework	From 5.3.0 (inc) to 5.3.50 (exc)
vmware	spring_framework	From 6.0.0 (inc) to 6.0.31 (exc)
vmware	spring_framework	to 5.2.26 (exc)
vmware	spring_framework	From 7.0.0 (inc) to 7.0.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Executive Summary

A Spring WebFlux application with WebSocket support may leak sensitive user information through exception messages that include request headers during WebSocket handshake failures.

Detection Guidance

To detect this vulnerability, check if your Spring Framework version falls within the affected ranges (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, or 7.0.0-7.0.8). Inspect WebSocket handshake logs for exception messages containing request headers.

Impact Analysis

Attackers could access sensitive data such as session tokens or authentication headers if an exception occurs during WebSocket connection setup, potentially leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability could result in unauthorized exposure of personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information, potentially leading to compliance violations and penalties.

Mitigation Strategies

Upgrade to a fixed version of Spring Framework: 5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, or 7.0.9 based on your current version. No additional mitigation steps are required beyond applying these updates.

Hi! I’m here to help you understand CVE-2026-47893. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70