CVE-2026-47889: Spring Framework XSS Vulnerability

CVE-2026-47889 Overview

CVE-2026-47889 affects Spring Framework applications built with WebFlux and deployed on the Jetty 12 Core reactive adapter. The framework serializes response cookies without preserving the SameSite attribute. Downstream, browsers treat these cookies with default cross-site handling rather than the developer-specified policy.

The defect weakens cross-site request forgery protections that depend on SameSite cookie enforcement. Applications relying on SameSite=Strict or SameSite=Lax to constrain cookie transmission lose that safeguard when running on the affected adapter.

Critical Impact
WebFlux applications on Jetty 12 Core lose SameSite cookie enforcement, exposing authentication and session cookies to cross-site request scenarios the developer intended to block.

Affected Products

Spring Framework 7.0.0 through 7.0.8
Spring Framework 6.2.0 through 6.2.19
WebFlux applications using the Jetty 12 Core reactive adapter

Discovery Timeline

2026-08-27 - CVE-2026-47889 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47889

Vulnerability Analysis

The issue lives in the response cookie serialization path used by the Jetty 12 Core reactive adapter in Spring WebFlux. When the framework converts a ResponseCookie object into the outbound Set-Cookie header, it fails to include the SameSite attribute value configured on the cookie. Browsers then apply their default policy instead of the application's declared policy.

The class of defect is a configuration and design flaw affecting cookie security semantics. It does not enable direct code execution, but it removes a browser-side control that applications rely on to constrain cookie transmission from third-party origins.

Applications built on the affected Spring Framework versions and deployed on other adapters, such as Netty or the Servlet adapter, are not described as impacted in the advisory. The behavior is specific to the Jetty 12 Core reactive integration.

Root Cause

The root cause is incomplete attribute serialization inside the WebFlux Jetty 12 Core adapter. The adapter constructs Set-Cookie headers from ResponseCookie instances but omits the SameSite attribute during header assembly. See the Spring Security Advisory CVE-2026-47889 for the authoritative technical description.

Attack Vector

An attacker hosts a malicious page that triggers a cross-site request against the vulnerable application. Because the SameSite attribute is missing on the wire, the browser attaches cookies that the application intended to withhold in a cross-site context. Session identifiers, CSRF tokens stored in cookies, and other authentication material can therefore accompany forged requests.

Exploitation requires a victim with an active session and requires the application to depend on SameSite for cross-site protection. The vulnerability mechanism is documented in the vendor advisory; no verified proof-of-concept code is available.

Detection Methods for CVE-2026-47889

Indicators of Compromise

Outbound Set-Cookie headers from WebFlux applications on Jetty 12 Core that lack the SameSite attribute despite the application configuring it.
Unexpected cookie transmission on cross-origin POST, PUT, or DELETE requests observed in web server or reverse proxy logs.
Successful state-changing requests originating from third-party Referer or Origin headers on authenticated endpoints.

Detection Strategies

Inspect production Set-Cookie headers with a browser developer console or an HTTP capture tool and confirm the presence of the SameSite attribute.
Add an integration test that asserts response cookies include the expected SameSite value when running under the Jetty 12 Core reactive adapter.
Review dependency manifests for spring-webflux versions in the 6.2.0-6.2.19 and 7.0.0-7.0.8 ranges combined with Jetty 12 Core.

Monitoring Recommendations

Alert on authenticated requests where Origin or Referer does not match the application origin.
Track anomalous CSRF token validation failures, which may indicate probing against cookie-based defenses.
Monitor Spring Boot dependency changes in CI to catch reintroduction of affected versions.

How to Mitigate CVE-2026-47889

Immediate Actions Required

Inventory WebFlux services and identify those bound to the Jetty 12 Core reactive adapter.
Upgrade Spring Framework to a fixed release as described in the Spring Security Advisory CVE-2026-47889.
Verify server-side CSRF protections remain enabled and do not rely solely on the SameSite cookie attribute.

Patch Information

Refer to the Spring Security Advisory CVE-2026-47889 for the list of fixed versions in the 6.2.x and 7.0.x branches. Apply the vendor-supplied upgrade to restore correct serialization of the SameSite attribute on the Jetty 12 Core reactive adapter.

Workarounds

Switch the WebFlux runtime to an unaffected reactive adapter, such as Netty, until the framework patch is applied.
Add a WebFilter that rewrites outbound Set-Cookie headers to include the required SameSite attribute.
Enforce synchronizer token pattern CSRF protection at the application layer so defenses do not depend on browser SameSite handling.

bash

# Configuration example
# Confirm affected dependency versions with Maven or Gradle
./mvnw dependency:tree | grep -E 'spring-webflux|jetty'
./gradlew dependencies | grep -E 'spring-webflux|jetty'