CVE-2026-47892: Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

August 27, 2026 (updated October 7, 2026)

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE

References

github.com/advisories/GHSA-9qf2-26p9-2q2q
nvd.nist.gov/vuln/detail/CVE-2026-47892
spring.io/security/cve-2026-47892

Code Behaviors & Features

Detect and mitigate CVE-2026-47892 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →