Information Exposure Through an Error Message in Spring Framework - CVE-2026-47893

Vulnerability identifier: #VU146226

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-47893

CWE-ID: CWE-209

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into error messages in HandshakeWebSocketService when handling WebSocket handshake requests. A remote attacker can send a request that triggers an exception to disclose sensitive information.

Spring Framework
Library Support for Spring
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version

Install security update from vendor's website.

Spring Framework - addressed in versions 5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0

• https://spring.io/security/cve-2026-47893

• Multiple vulnerabilities in Spring Framework
• Multiple vulnerabilities in IBM Library Support for Spring
• Multiple vulnerabilities in IBM OpenPages for Cloud Pak for Data