CVE-2026-47889: Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse

Q: Which applications are affected?

Applications using Spring WebFlux with the Jetty 12 Core reactive adapter are affected. The issue is identified in Spring Framework versions 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19.

Q: How can I determine whether my application is exposed?

Check whether the application uses WebFlux on the Jetty 12 Core reactive adapter and sets SameSite on response cookies. Affected responses serialize cookies without the sameSite attribute.

Published Aug 27, 2026

Updated

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

Affected Software

1 affected component

Spring Spring Framework>=7.0.0<=7.0.8, >=6.2.0<=6.2.19

Event History

Aug 27, 2026

CVE Published

via MITRE·05:21 AM

Data Sourced

via MITRE·05:21 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which applications are affected?

Applications using Spring WebFlux with the Jetty 12 Core reactive adapter are affected. The issue is identified in Spring Framework versions 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19.

How can I determine whether my application is exposed?

Check whether the application uses WebFlux on the Jetty 12 Core reactive adapter and sets SameSite on response cookies. Affected responses serialize cookies without the sameSite attribute.