Open redirect in Spring Framework - CVE-2026-47883
Published: August 28, 2026
Vulnerability identifier: #VU146222
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47883
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect users to an arbitrary URL.
The vulnerability exists due to an open redirect in UrlHandlerFilter when processing requests with very broadly matching patterns. A remote attacker can craft a request that triggers a redirect to an arbitrary URL to redirect users to an arbitrary URL.
The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Affected software
Spring Framework
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-47883
Install security update from vendor's website.
Spring Framework - addressed in versions 6.2.20, 7.0.8.1, 7.0.9
Library Support for Spring - update to 3.5.19
Library Support for Spring - update to 3.5.19