CVE-2026-47883CWE-601

CVE-2026-47883

Medium · published August 27, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.

Spring Framework 7.0.0 - 7.0.8

Spring Framework 6.2.0 - 6.2.19

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00261 · 16.8th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-08-27T10:17Z
Affected products (2)
ProductVersionsFixed in
vmware/spring_framework≥ 6.2.0, < 6.2.206.2.20
vmware/spring_framework≥ 7.0.0, < 7.0.8.17.0.8.1
References (1)
https://spring.io/security/cve-2026-47883 · [email protected]
EPSS history
Timeline
  • 28 AUG 06:43Z
    EPSS moved — → 0%
    epss
  • 27 AUG 05:21Z
    Spring Framework Open Redirect in UrlHandlerFilter
    cvelistv5