GHSA-9qf2-26p9-2q2q

Source

https://github.com/advisories/GHSA-9qf2-26p9-2q2q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9qf2-26p9-2q2q/GHSA-9qf2-26p9-2q2q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9qf2-26p9-2q2q

Aliases

CVE-2026-47892

Downstream

CGA (25)

ECHO (1)

ECHO-145e-f4d1-a3a6

Published

2026-08-27T06:31:34Z

Modified

2026-10-07T13:30:04Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

Details

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE

Database specific

{
    "cwe_ids": [
        "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T13:20:45Z",
    "nvd_published_at": "2026-08-27T06:17:20Z",
    "severity": "CRITICAL"
}

References

Affected packages

Maven

org.springframework:spring-webflux

Package

Name: org.springframework:spring-webflux; View open source insights on deps.dev
Purl: pkg:maven/org.springframework/spring-webflux

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.2.5.RELEASE

Last Affected

5.2.25.RELEASE

Affected versions

5.*

5.2.5.RELEASE

5.2.6.RELEASE

5.2.7.RELEASE

5.2.8.RELEASE

5.2.9.RELEASE

5.2.10.RELEASE

5.2.11.RELEASE

5.2.12.RELEASE

5.2.13.RELEASE

5.2.14.RELEASE

5.2.15.RELEASE

5.2.16.RELEASE

5.2.17.RELEASE

5.2.18.RELEASE

5.2.19.RELEASE

5.2.20.RELEASE

5.2.21.RELEASE

5.2.22.RELEASE

5.2.23.RELEASE

5.2.24.RELEASE

5.2.25.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9qf2-26p9-2q2q/GHSA-9qf2-26p9-2q2q.json"

org.springframework:spring-webflux

Package

Name: org.springframework:spring-webflux; View open source insights on deps.dev
Purl: pkg:maven/org.springframework/spring-webflux

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.3.0

Last Affected

5.3.49

Affected versions

5.*

5.3.0

5.3.1

5.3.2

5.3.3

5.3.4

5.3.5

5.3.6

5.3.7

5.3.8

5.3.9

5.3.10

5.3.11

5.3.12

5.3.13

5.3.14

5.3.15

5.3.16

5.3.17

5.3.18

5.3.19

5.3.20

5.3.21

5.3.22

5.3.23

5.3.24

5.3.25

5.3.26

5.3.27

5.3.28

5.3.29

5.3.30

5.3.31

5.3.32

5.3.33

5.3.34

5.3.35

5.3.36

5.3.37

5.3.38

5.3.39

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9qf2-26p9-2q2q/GHSA-9qf2-26p9-2q2q.json"

org.springframework:spring-webflux

Package

Name: org.springframework:spring-webflux; View open source insights on deps.dev
Purl: pkg:maven/org.springframework/spring-webflux

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Last Affected

6.0.30

Affected versions

6.*

6.0.0

6.0.1

6.0.2

6.0.3

6.0.4

6.0.5

6.0.6

6.0.7

6.0.8

6.0.9

6.0.10

6.0.11

6.0.12

6.0.13

6.0.14

6.0.15

6.0.16

6.0.17

6.0.18

6.0.19

6.0.20

6.0.21

6.0.22

6.0.23

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9qf2-26p9-2q2q/GHSA-9qf2-26p9-2q2q.json"

org.springframework:spring-webflux

Package

Name: org.springframework:spring-webflux; View open source insights on deps.dev
Purl: pkg:maven/org.springframework/spring-webflux

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.1.0

Last Affected

6.1.28

Affected versions

6.*

6.1.0

6.1.1

6.1.2

6.1.3

6.1.4

6.1.5

6.1.6

6.1.7

6.1.8

6.1.9

6.1.10

6.1.11

6.1.12

6.1.13

6.1.14

6.1.15

6.1.16

6.1.17

6.1.18

6.1.19

6.1.20

6.1.21

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9qf2-26p9-2q2q/GHSA-9qf2-26p9-2q2q.json"

org.springframework:spring-webflux

Package

Name: org.springframework:spring-webflux; View open source insights on deps.dev
Purl: pkg:maven/org.springframework/spring-webflux

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.2.0

Last Affected

6.2.19

Affected versions

6.*

6.2.0

6.2.1

6.2.2

6.2.3

6.2.4

6.2.5

6.2.6

6.2.7

6.2.8

6.2.9

6.2.10

6.2.11

6.2.12

6.2.13

6.2.14

6.2.15

6.2.16

6.2.17

6.2.18

6.2.19

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9qf2-26p9-2q2q/GHSA-9qf2-26p9-2q2q.json"

org.springframework:spring-webflux

Package

Name: org.springframework:spring-webflux; View open source insights on deps.dev
Purl: pkg:maven/org.springframework/spring-webflux

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.0.9

Affected versions

7.*

7.0.0

7.0.1

7.0.2

7.0.3

7.0.4

7.0.5

7.0.6

7.0.7

7.0.8

Database specific

last_known_affected_version_range

"<= 7.0.8"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9qf2-26p9-2q2q/GHSA-9qf2-26p9-2q2q.json"