{"id":"CVE-2026-47889","aliases":["CLSA-2026-1788201541","CLSA-2026-1788253139","CLSA-2026-1788276305","CLSA-2026-1788276466","CLSA-2026-1789703693","CLSA-2026-1789722420","CLSA-2026-1790068919","CLSA-2026-1790069169","CLSA-2026-1792590675","CLSA-2026-1793900222","EUVD-2026-66857","GHSA-53cv-4frm-9p27","UBUNTU-CVE-2026-47889"],"status":"published","title":"Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse","description":"A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00428,"percentile":0.37337,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1275"],"published":"2026-08-27T05:21:37Z","modified":"2026-11-06T13:15:22Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.7"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5","6.2.15-tuxcare.6"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.1"}]}],"versions":["6.2.7"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.7.RELEASE"},{"fixed":"5.1.7.RELEASE-tuxcare.3"}]}],"versions":["5.1.7.RELEASE","5.1.7.RELEASE-tuxcare.1","5.1.7.RELEASE-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.7.RELEASE"},{"fixed":"5.1.7.RELEASE-tuxcare.3"}]}],"versions":["5.1.7.RELEASE","5.1.7.RELEASE-tuxcare.1","5.1.7.RELEASE-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.7.RELEASE"},{"fixed":"5.1.7.RELEASE-tuxcare.3"}]}],"versions":["5.1.7.RELEASE","5.1.7.RELEASE-tuxcare.1","5.1.7.RELEASE-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.7.RELEASE"},{"fixed":"5.1.7.RELEASE-tuxcare.3"}]}],"versions":["5.1.7.RELEASE","5.1.7.RELEASE-tuxcare.1","5.1.7.RELEASE-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.7.RELEASE"},{"fixed":"5.1.7.RELEASE-tuxcare.3"}]}],"versions":["5.1.7.RELEASE","5.1.7.RELEASE-tuxcare.1","5.1.7.RELEASE-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.6.RELEASE-7","3.0.6.RELEASE-8","3.0.6.RELEASE-9","3.0.6.RELEASE-10","3.0.6.RELEASE-11","3.0.6.RELEASE-12","3.0.6.RELEASE-13","3.0.6.RELEASE-13ubuntu0.1~esm1","3.0.6.RELEASE-13ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.13-3","3.2.13-4","3.2.13-5","3.2.13-5ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.11-1","4.3.12-1","4.3.13-2","4.3.14-1","4.3.22-1~18.04","4.3.22-1~18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.22-4","4.3.22-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-1","4.3.30-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2","4.3.30-2ubuntu0.24.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]}],"products":[{"vendor":"spring","product":"spring framework"},{"vendor":"vmware","product":"spring framework"},{"vendor":"vmware","product":"spring_framework"}],"references":[{"url":"https://spring.io/security/cve-2026-47889","tags":["Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47889"},{"url":"https://github.com/advisories/GHSA-53cv-4frm-9p27"},{"url":"https://ubuntu.com/security/CVE-2026-47889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47889","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-47889","title":"Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse","description":"A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T05:21:37.305Z","modified":"2026-08-27T14:57:20.579Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-1275"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-66857","description":"A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T05:21:37Z","modified":"2026-08-27T14:57:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:28.115205Z"}],"ghsa":[{"id":"GHSA-53cv-4frm-9p27","title":"A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies...","description":"A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T06:31:34Z","modified":"2026-08-27T18:33:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-1275"],"updated_at":"2026-11-02T15:11:05.100142Z"}],"nvd":[{"id":"CVE-2026-47889","description":"A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T06:17:19.867Z","modified":"2026-09-10T14:48:04.053Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-1275"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"UBUNTU-CVE-2026-47889","description":"A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T06:17:00Z","modified":"2026-10-17T13:00:22.945456056Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"CLSA-2026-1788201541","title":"TuxCare security update for org.springframework (17 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 17 CVEs. Fixed in 6.2.19-tuxcare.1.","status":"published","published":"2026-08-31T18:39:01Z","modified":"2026-11-02T19:46:02.876660676Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788253139","title":"TuxCare security update for org.springframework (20 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 20 CVEs. Fixed in 6.2.1-tuxcare.4.","status":"published","published":"2026-09-01T08:58:59Z","modified":"2026-11-02T19:46:02.08031646Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788276305","title":"TuxCare security update for org.springframework (25 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 25 CVEs. Fixed in 6.2.13-tuxcare.2.","status":"published","published":"2026-09-01T15:25:05Z","modified":"2026-11-02T19:46:03.67461284Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788276466","title":"TuxCare security update for org.springframework (17 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 17 CVEs. Fixed in 6.2.15-tuxcare.7.","status":"published","published":"2026-09-01T15:27:46Z","modified":"2026-11-02T19:46:05.698704454Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1789703693","title":"TuxCare security update for org.springframework (36 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 36 CVEs. Fixed in 6.2.5-tuxcare.1.","status":"published","published":"2026-09-18T03:54:53Z","modified":"2026-11-02T19:46:19.189753568Z","updated_at":"2026-11-02T20:29:28.838259Z"},{"id":"CLSA-2026-1789722420","title":"TuxCare security update for org.springframework (34 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 34 CVEs. Fixed in 6.2.12-tuxcare.1.","status":"published","published":"2026-09-18T09:07:00Z","modified":"2026-11-02T19:46:18.4339041Z","updated_at":"2026-11-02T20:29:28.838259Z"},{"id":"CLSA-2026-1790068919","title":"TuxCare security update for org.springframework (33 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 33 CVEs. Fixed in 6.2.14-tuxcare.1.","status":"published","published":"2026-09-22T09:21:59Z","modified":"2026-11-02T19:46:21.56620398Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1790069169","title":"TuxCare security update for org.springframework (32 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 32 CVEs. Fixed in 6.2.3-tuxcare.1.","status":"published","published":"2026-09-22T09:26:09Z","modified":"2026-11-02T19:46:20.214671354Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1792590675","title":"TuxCare security update for org.springframework (32 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 32 CVEs. Fixed in 6.2.7-tuxcare.1.","status":"published","published":"2026-10-21T13:51:15Z","modified":"2026-11-02T19:46:29.936376767Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793900222","title":"TuxCare security update for org.springframework (8 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 8 CVEs. Fixed in 5.1.7.RELEASE-tuxcare.3.","status":"published","published":"2026-11-05T18:37:03Z","modified":"2026-11-06T13:15:22.3106304Z","updated_at":"2026-11-06T13:44:09.891978Z"}]}}