Read the docs
TI-2026-35331 Aliases CVE-2026-47883GHSA-j94g-vwjh-xffq

Spring Framework Open Redirect in UrlHandlerFilter

Priority LOW 27CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Deferred Red Hat: fix deferred

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-601.

Summary

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00261 17th percentileScored 2026-11-07
Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring Framework7.0.0 – 7.0.8; 6.2.0 – 6.2.19—No fix listedCNA
  • Spring Framework VendorVMware Affected 7.0.0 – 7.0.8; 6.2.0 – 6.2.19 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*6.2.0 to before 6.2.20; 7.0.0 to before 7.0.8.1VulnerableVMware
  • cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions 6.2.0 to before 6.2.20; 7.0.0 to before 7.0.8.1 Vulnerable ·VMware

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Red Hat Single Sign-On 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet: Fix deferred
Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47883
  2. 2026-10-03 Alias added: GHSA-j94g-vwjh-xffq

References

Advisory 1

  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
  • TI-2018-01180 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2016-09283 Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution… CVSS 3.1CRITICAL 9.8
  • TI-2014-00050 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8… CVSS 2.0MEDIUM 6.8
See all 82 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences