Detections
Analytics
Spring Framework 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities
critical Nessus Plugin ID 341190
Synopsis
The Spring Framework install on the remote host is affected by multiple vulnerabilities.Description
The version of Spring Framework installed on the remote host is 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by multiple vulnerabilities:- UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. (CVE-2026-47883)
- A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. (CVE-2026-47889)
- Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. An attacker with control over data that will be streamed to other users might corrupt the stream of data sent to those users. (CVE-2026-47890)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Spring Framework version 6.2.20 / 7.0.8.1 / 7.0.9 or later. Note that some fixed releases are available to Enterprise Support customers only; refer to the vendor advisory for details.See Also
https://spring.io/security/cve-2026-47883
Plugin Details
Severity: Critical
ID: 341190
File Name: spring_framework_CVE-2026-47883_CVE-2026-47889_CVE-2026-47890.nasl
Version: 1.2
Type: Local
Agent: windows, macosx, unix
Family: Misc.
Published: 8/28/2026
Updated: 8/28/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.18
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P
CVSS Score Source: CVE-2026-47890
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2026-47890
Vulnerability Information
CPE: cpe:/a:pivotal_software:spring_framework, cpe:/a:vmware:spring_framework
Required KB Items: installed_sw/Spring Framework
Patch Publication Date: 8/20/2026
Vulnerability Publication Date: 8/20/2026