Threats Tagged 'ghsa-53cv-4frm-9p27'

CVE-2026-47889 is a high-severity vulnerability in the Spring Framework versions 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19. It affects WebFlux applications running on the Jetty 12 Core reactive adapter, where response cookies are serialized without the SameSite attribute. This omission can cause sensitive cookies to be sent in cross-site requests, increasing the risk of cross-site request forgery (CSRF) attacks. No official patch or remediation guidance is currently available.