CVE-2026-47883: Spring Framework Open Redirect in UrlHandlerFilter

Q: Which deployments are exposed to this issue?

Applications using UrlHandlerFilter in either Spring MVC or Spring WebFlux are affected when the filter is configured with very broadly matching patterns. The affected version ranges are Spring Framework 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19.

Q: Does every application using Spring Framework have this vulnerability?

No. The issue is described as depending on UrlHandlerFilter being configured with very broadly matching patterns. The provided information does not indicate that this is a default configuration.

Published Aug 27, 2026

Updated

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

Affected Software

1 affected component

Spring Spring Framework>=7.0.0<=7.0.8, >=6.2.0<=6.2.19

Event History

Aug 27, 2026

CVE Published

via MITRE·05:21 AM

Data Sourced

via MITRE·05:21 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using UrlHandlerFilter in either Spring MVC or Spring WebFlux are affected when the filter is configured with very broadly matching patterns. The affected version ranges are Spring Framework 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19.

Does every application using Spring Framework have this vulnerability?

No. The issue is described as depending on UrlHandlerFilter being configured with very broadly matching patterns. The provided information does not indicate that this is a default configuration.