CVE-2026-47892: Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 5.2.25.RELEASE - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.2.19 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.1.28 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.0.30 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 5.3.49 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 7.0.8
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue applies to WebFlux applications that use functional endpoints and are deployed with DispatcherServlet. Applications outside that combination are not identified as affected by the available information.
Which Spring Framework versions are affected?
Affected versions are 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.5.RELEASE through 5.2.25.RELEASE.
What request type is involved in exploitation?
The bypass occurs in a pre-flight request and concerns header predicates on WebFlux functional endpoints. The provided information does not specify additional attacker prerequisites or a workaround.