CVE-2026-47893: CWE-209 Generation of Error Message Containing Sensitive Information in Spring Spring Framework

This vulnerability (CWE-209) occurs in Spring WebFlux applications that support WebSocket connections. When an exception is raised, the error message may include request headers, which can indirectly expose sensitive user information. The affected versions span multiple major releases of the Spring Framework, including 5.2.25.RELEASE and earlier, 5.3.0 through 5.3.49, 6.0.0 through 6.0.30, 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No known exploits in the wild or official remediation details are currently provided.

The vulnerability can lead to the exposure of sensitive user information through error messages that include request headers. This confidentiality breach could aid attackers in gathering information about users or the system environment. There is no impact on integrity or availability reported. The vulnerability is remotely exploitable without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review application error handling configurations to avoid including sensitive request headers in exception messages. Monitor vendor communications for updates on patches or official mitigations.