CVE-2026-47892

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Spring Framework versions 5.2.5.RELEASE through 5.2.25.RELEASE

Description A WebFlux application using functional endpoints and deployed with DispatcherServlet may be susceptible to a header predicate bypass during a pre-flight request. A pre-flight request is a preliminary request used in Cross-Origin Resource Sharing (CORS) to verify if the server permits the actual request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.