CVE-2026-47893: Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService

Q: Which applications are affected?

Spring WebFlux applications that support WebSocket connections may be affected. The issue applies to Spring Framework 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier.

Q: What information could be exposed?

Request headers may be included in an exception reason, potentially exposing indirectly sensitive user information contained in those headers.

Published Aug 27, 2026

Updated

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Affected Software

1 affected component

Spring Spring Framework>=7.0.0<=7.0.8, >=6.2.0<=6.2.19, >=6.1.0<=6.1.28, >=6.0.0<=6.0.30, >=5.3.0<=5.3.49, <=5.2.25.RELEASE

Event History

Aug 27, 2026

CVE Published

via MITRE·05:21 AM

Data Sourced

via MITRE·05:21 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which applications are affected?

Spring WebFlux applications that support WebSocket connections may be affected. The issue applies to Spring Framework 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier.

What information could be exposed?

Request headers may be included in an exception reason, potentially exposing indirectly sensitive user information contained in those headers.