CVE-2026-47883: Spring Framework Open Redirect in UrlHandlerFilter

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-27 · updated 2026-09-10
Weakness: CWE-601

Description

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

Affected products

Spring Framework: from 6.2.0 before 6.2.20; from 7.0.0 before 7.0.8.1 — fixed in 6.2.20, 7.0.8.1
Spring Framework: from 7.0.0 through 7.0.8; from 6.2.0 through 6.2.19

How to fix

Upgrade to a fixed version: Spring Framework 6.2.20, 7.0.8.1. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-47883

Get alerted when CVE-2026-47883 or the next vulnerability affects your stack