CVE-2026-47892

creationtimestamp| type| source ---|---|--- 2026-08-28 19:50:10+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu6535lcfv2t...

Spring Framework 5.2.5 < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Header Predicate Bypass in WebFlux Functional Endpoints

The version of Spring Framework installed on the remote host is 5.2.5 prior to 5.2.26, 5.3.x prior to 5.3.50, 6.0.x prior to 6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by a vulnerability: - A WebFlux application using functional...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +2612 more potentially affected by CVE-2026-47892 via org.springframework:spring-webflux (>=6.2.0, <=6.2.19)

org.springframework:spring-webflux MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-47892 Source advisory: OSV:GHSA-9QF2-26P9-2Q2Q...

ai.optfor:spring-openai-api (>=0.2.2, <=0.3.25), app.boboc:webflux-websocket-coroutine (>=0.0.6, <=1.0.0) +1030 more potentially affected by CVE-2026-47892 via org.springframework:spring-webflux (>=6.0.0, <=6.0.23)

org.springframework:spring-webflux MAVEN version =6.0.0, =0.2.2, =0.0.6, =0.0.6, =4.5.0-beta.1, =0.14.0, =0.15.0-rc2, =0.15.0-rc2, =0.15.0-rc2, =0.15.0 and more Source cves: CVE-2026-47892 Source advisory: GHSA-9QF2-26P9-2Q2Q...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.1.1, <=0.112.0) +1752 more potentially affected by CVE-2026-47892 via org.springframework:spring-webflux (>=6.1.0, <=6.1.21)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =0.5.0, =1.2.0, =1.1.0, =1.3.0 and more Source cves: CVE-2026-47892 Source advisory: OSV:GHSA-9QF2-26P9-2Q2Q...

cve-2026-47892 - MEDIUM - Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

cve-2026-47892 - MEDIUM - Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints...