CVE-2026-47883
published 2026-08-27CVE-2026-47883: UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both…
PriorityP425medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.26%
16.8th percentile
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| spring | spring_framework | 6.2.0 – 6.2.19 | — |
| spring | spring_framework | 7.0.0 – 7.0.8 | — |
| vmware | spring_framework | >= 6.2.0 < 6.2.20 | 6.2.20 |
| vmware | spring_framework | >= 7.0.0 < 7.0.8.1 | 7.0.8.1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns.
ghsa_unreviewed·2026-08-27
CVE-2026-47883 [MEDIUM] CWE-601 UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns.
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Red Hat
org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Open redirect vulnerability in UrlHandlerFilter via broadly matching patterns
vendor_redhat·2026-08-27·CVSS 6.1
CVE-2026-47883 [MEDIUM] CWE-601 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Open redirect vulnerability in UrlHandlerFilter via broadly matching patterns
org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Open redirect vulnerability in UrlHandlerFilter via broadly matching patterns
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
A flaw was found in the UrlHandlerFilter component of Spring Framework. When this filter is configured with overly broad patterns, it can be vulnerable to an open redirect. A remote attacker could exploit this by crafting a malicious URL, which, when clicked by a user, redirects them to an arbitrary external website. This could be used in phishing attacks to trick users into re
No detection rules found.
No public exploits indexed.
2026-08-27
Published