Executive brief
Spring Framework, a widely-used Java web application framework, contains a vulnerability in its WebFlux component that allows attackers to bypass security checks on HTTP requests. When applications use functional endpoints with the DispatcherServlet, an attacker can craft malicious pre-flight requests to circumvent header-based security predicates, potentially gaining unauthorized access to protected resources.
Technical details
The vulnerability is a header predicate bypass in Spring Framework's WebFlux functional endpoints when deployed with DispatcherServlet. The root cause involves improper validation of HTTP headers during pre-flight request processing, allowing attackers to craft requests that bypass header-based security predicates intended to restrict access. The attack vector is network-based and requires no authentication. An attacker can exploit this by sending specially crafted pre-flight requests to access protected endpoints or resources that should be restricted by header validation rules. Patches are available for affected versions (Spring Framework 5.2.26+, 5.3.50+, 6.0.31+, 6.1.29+, 6.2.20+, and 7.0.9+).
Affected products
- Spring Spring Framework 5.2.5.RELEASE through 5.2.25.RELEASE, 5.3.0 through 5.3.49, 6.0.0 through 6.0.30, 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, 7.0.0 through 7.0.8
Timeline
- 2026-08-27: disclosed: CVE-2026-47892 published