CVE-2026-47889

Spring Framework WebFlux applications running on the Jetty 12 Core reactive adapter serialize response cookies without the sameSite attribute. The defect occurs in JettyCoreServerHttpResponse , where the attribute is dropped during serialization. This can weaken protection against cross-site requ...