{"id":"CVE-2026-47883","aliases":["CLSA-2026-1788201541","CLSA-2026-1788253139","CLSA-2026-1788276305","CLSA-2026-1788276466","CLSA-2026-1789703693","CLSA-2026-1789722420","CLSA-2026-1790068919","CLSA-2026-1790069169","CLSA-2026-1792590675","EUVD-2026-66851","GHSA-j94g-vwjh-xffq","UBUNTU-CVE-2026-47883"],"status":"published","title":"Spring Framework Open Redirect in UrlHandlerFilter","description":"UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00261,"percentile":0.17902,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-601"],"published":"2026-08-27T05:21:32Z","modified":"2026-11-02T19:46:29Z","exploits":[{"source":"pocgithub","id":"daehyuh/CVE-2026-47883","title":"daehyuh/CVE-2026-47883","date":"2026-05-20","url":"https://github.com/daehyuh/CVE-2026-47883"}],"affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.6.RELEASE-7","3.0.6.RELEASE-8","3.0.6.RELEASE-9","3.0.6.RELEASE-10","3.0.6.RELEASE-11","3.0.6.RELEASE-12","3.0.6.RELEASE-13","3.0.6.RELEASE-13ubuntu0.1~esm1","3.0.6.RELEASE-13ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.13-3","3.2.13-4","3.2.13-5","3.2.13-5ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.11-1","4.3.12-1","4.3.13-2","4.3.14-1","4.3.22-1~18.04","4.3.22-1~18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.22-4","4.3.22-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-1","4.3.30-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2","4.3.30-2ubuntu0.24.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]}],"products":[{"vendor":"spring","product":"spring framework"},{"vendor":"vmware","product":"spring framework"},{"vendor":"vmware","product":"spring_framework"}],"references":[{"url":"https://spring.io/security/cve-2026-47883","tags":["Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47883"},{"url":"https://github.com/advisories/GHSA-j94g-vwjh-xffq"},{"url":"https://ubuntu.com/security/CVE-2026-47883","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47883","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-47883","title":"Spring Framework Open Redirect in UrlHandlerFilter","description":"UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T05:21:32.084Z","modified":"2026-08-27T15:02:25.563Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-66851","description":"UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T05:21:32Z","modified":"2026-08-27T15:02:25Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:28.115205Z"}],"ghsa":[{"id":"GHSA-j94g-vwjh-xffq","title":"UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching...","description":"UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T06:31:34Z","modified":"2026-08-27T18:32:10Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:11:03.796873Z"}],"nvd":[{"id":"CVE-2026-47883","description":"UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T06:17:18.29Z","modified":"2026-09-10T14:54:50.113Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"UBUNTU-CVE-2026-47883","description":"UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T06:17:00Z","modified":"2026-10-17T13:00:21.720659713Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"CLSA-2026-1788201541","title":"TuxCare security update for org.springframework (17 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 17 CVEs. Fixed in 6.2.19-tuxcare.1.","status":"published","published":"2026-08-31T18:39:01Z","modified":"2026-11-02T19:46:02.876660676Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788253139","title":"TuxCare security update for org.springframework (20 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 20 CVEs. Fixed in 6.2.1-tuxcare.4.","status":"published","published":"2026-09-01T08:58:59Z","modified":"2026-11-02T19:46:02.08031646Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788276305","title":"TuxCare security update for org.springframework (25 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 25 CVEs. Fixed in 6.2.13-tuxcare.2.","status":"published","published":"2026-09-01T15:25:05Z","modified":"2026-11-02T19:46:03.67461284Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788276466","title":"TuxCare security update for org.springframework (17 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 17 CVEs. Fixed in 6.2.15-tuxcare.7.","status":"published","published":"2026-09-01T15:27:46Z","modified":"2026-11-02T19:46:05.698704454Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1789703693","title":"TuxCare security update for org.springframework (36 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 36 CVEs. Fixed in 6.2.5-tuxcare.1.","status":"published","published":"2026-09-18T03:54:53Z","modified":"2026-11-02T19:46:19.189753568Z","updated_at":"2026-11-02T20:29:28.838259Z"},{"id":"CLSA-2026-1789722420","title":"TuxCare security update for org.springframework (34 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 34 CVEs. Fixed in 6.2.12-tuxcare.1.","status":"published","published":"2026-09-18T09:07:00Z","modified":"2026-11-02T19:46:18.4339041Z","updated_at":"2026-11-02T20:29:28.838259Z"},{"id":"CLSA-2026-1790068919","title":"TuxCare security update for org.springframework (33 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 33 CVEs. Fixed in 6.2.14-tuxcare.1.","status":"published","published":"2026-09-22T09:21:59Z","modified":"2026-11-02T19:46:21.56620398Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1790069169","title":"TuxCare security update for org.springframework (32 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 32 CVEs. Fixed in 6.2.3-tuxcare.1.","status":"published","published":"2026-09-22T09:26:09Z","modified":"2026-11-02T19:46:20.214671354Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1792590675","title":"TuxCare security update for org.springframework (32 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 32 CVEs. Fixed in 6.2.7-tuxcare.1.","status":"published","published":"2026-10-21T13:51:15Z","modified":"2026-11-02T19:46:29.936376767Z","updated_at":"2026-11-02T20:28:59.01272Z"}]}}