CVE-2026-47883

published 2026-08-27

CVE-2026-47883: UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both…

Priority P4 25 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19

Affected

4 ranges

Vendor	Product	Version range	Fixed in
spring	spring_framework	6.2.0 – 6.2.19	—
spring	spring_framework	7.0.0 – 7.0.8	—
vmware	spring_framework	>= 6.2.0 < 6.2.20	6.2.20
vmware	spring_framework	>= 7.0.0 < 7.0.8.1	7.0.8.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-601