Spring Framework 5.2-7.0 WS Header Leak (CVE-202647893)
CVE-2026-47893 Published on August 27, 2026
Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Products Associated with CVE-2026-47893
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring Framework:- Version 7.0.0, <= 7.0.8 is affected.
- Version 6.2.0, <= 6.2.19 is affected.
- Version 6.1.0, <= 6.1.28 is affected.
- Version 6.0.0, <= 6.0.30 is affected.
- Version 5.3.0, <= 5.3.49 is affected.
- Before and including 5.2.25.RELEASE is affected.