CVE-2026-47893

score

4.6

cvss

7.5

epss

0.4%

published

2026-08-27

kev added

—

first seen

2026-10-21

Spring Framework 5.2.25.RELEASE and earlier, 5.3.0 - 5.3.49, 6.0.0 - 6.0.30, 6.1.0 - 6.1.28, 6.2.0 - 6.2.19, and 7.0.0 - 7.0.8 contain an information disclosure vulnerability caused by inclusion of request headers in exception reasons in WebFlux WebSocket connections, letting attackers indirectly access sensitive user information, exploit requires triggering exceptions via WebSocket requests.