PT-2026-82411 · Vmware · Spring Framework
CVE-2026-47893
·
Published
2026-08-27
·
Updated
2026-08-27
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Spring Framework versions 7.0.0 through 7.0.8
Spring Framework versions 6.2.0 through 6.2.19
Spring Framework versions 6.1.0 through 6.1.28
Spring Framework versions 6.0.0 through 6.0.30
Spring Framework versions 5.3.0 through 5.3.49
Spring Framework versions prior to 5.2.25.RELEASE
Description
A Spring WebFlux application supporting WebSocket connections may indirectly expose sensitive user information. This occurs when request headers are included within an exception reason in the
HandshakeWebsocketService.Recommendations
Update to a version newer than 7.0.8
Update to a version newer than 6.2.19
Update to a version newer than 6.1.28
Update to a version newer than 6.0.30
Update to a version newer than 5.3.49
Update to a version newer than 5.2.25.RELEASE
Fix
Generation of Error Message Containing Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Spring Framework