PT-2026-82407

CVE-2026-47889

Published

2026-08-27

Updated

2026-10-08

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19

Description A WebFlux application using the Jetty 12 Core reactive adapter fails to include the sameSite attribute when serializing response cookies. This attribute is used to control whether cookies are sent with cross-site requests, providing protection against Cross-Site Request Forgery (CSRF).

Recommendations Update Spring Framework versions 7.0.0 through 7.0.8 to a newer version. Update Spring Framework versions 6.2.0 through 6.2.19 to a newer version.

Exploitability

Fix

Vendors

Affected products

Weakness enumeration

CWE-1275: Sensitive Cookie with Improper SameSite Attribute

Related identifiers

CVE-2026-47889

CLEANSTART-2026-BU33192

CLEANSTART-2026-EC45528

CLEANSTART-2026-LY84438

CLEANSTART-2026-MK68457