CVE-2026-47889 - Vulnerability Details - OpenCVE

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Spring	Spring Framework

No data.

No data.

References

Link	Providers
https://spring.io/security/cve-2026-47889

History

Thu, 27 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-352

Thu, 27 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1275
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 27 Aug 2026 08:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Spring Spring spring Framework
Vendors & Products		Spring Spring spring Framework

Thu, 27 Aug 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-352

Thu, 27 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
Title		Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
References		https://spring.io/security/cve-2026-47889

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2026-08-27T05:21:37.305Z

Updated: 2026-08-27T14:57:20.579Z

Reserved: 2026-05-20T10:01:00.477Z

Link: CVE-2026-47889

Vulnrichment

Updated: 2026-08-27T14:57:15.530Z

NVD

Status : Awaiting Analysis

Published: 2026-08-27T06:17:19.867

Modified: 2026-08-28T18:47:30.163

Link: CVE-2026-47889

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47889", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-05-20T10:01:00.477Z", "datePublished": "2026-08-27T05:21:37.305Z", "dateUpdated": "2026-08-27T14:57:20.579Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-27T05:21:37.305Z"}, "title": "Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1275 Sensitive Cookie with Improper SameSite Attribute", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute."}]}], "affected": [{"vendor": "Spring", "product": "Spring Framework", "versions": [{"status": "affected", "version": "7.0.0", "lessThanOrEqual": "7.0.8", "versionType": "custom"}, {"status": "affected", "version": "6.2.0", "lessThanOrEqual": "6.2.19", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.</p><p>Spring Framework 7.0.0 - 7.0.8<br/>Spring Framework 6.2.0 - 6.2.19</p>"}]}], "references": [{"url": "https://spring.io/security/cve-2026-47889"}], "source": {"discovery": "UNKNOWN"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1275", "lang": "en", "description": "CWE-1275 Sensitive Cookie with Improper SameSite Attribute"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-27T14:56:53.721017Z", "id": "CVE-2026-47889", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T14:57:20.579Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-47889", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T14:56:53.721017Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1275", "description": "CWE-1275 Sensitive Cookie with Improper SameSite Attribute"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T14:57:15.530Z"}}], "cna": {"title": "Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute."}]}], "affected": [{"vendor": "Spring", "product": "Spring Framework", "versions": [{"status": "affected", "version": "7.0.0", "versionType": "custom", "lessThanOrEqual": "7.0.8"}, {"status": "affected", "version": "6.2.0", "versionType": "custom", "lessThanOrEqual": "6.2.19"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2026-47889"}], "descriptions": [{"lang": "en", "value": "A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19", "supportingMedia": [{"type": "text/html", "value": "<p>A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.</p><p>Spring Framework 7.0.0 - 7.0.8<br/>Spring Framework 6.2.0 - 6.2.19</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-1275 Sensitive Cookie with Improper SameSite Attribute"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-27T05:21:37.305Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47889", "state": "PUBLISHED", "dateUpdated": "2026-08-27T14:57:20.579Z", "dateReserved": "2026-05-20T10:01:00.477Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-08-27T05:21:37.305Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}