---
id: CVE-2026-47883
title: >-
  UrlHandlerFilter can be vulnerable to an open redirect when configured with
  very broadly matching patterns
summary: >-
  UrlHandlerFilter can be vulnerable to an open redirect when configured with
  very broadly matching patterns. The issue applies to the filter variants in
  both Spring MVC and Spring WebFlux.

  Spring Framework 7.0.0 - 7.0.8

  Spring Framework 6…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-601
vendor: vmware
product: spring_framework
affected:
  - 'spring_framework >= 6.2.0, < 6.2.20'
  - 'spring_framework >= 7.0.0, < 7.0.8.1'
patched:
  - spring_framework 7.0.8.1
published: '2026-08-27'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T14:54:50.113'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47883'
references:
  - url: 'https://spring.io/security/cve-2026-47883'
    label: security@vmware.com
tags:
  - nvd
  - cve.org
  - exploit-available
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-27T15:01:51.233776Z'
ingestedAt: '2026-09-13T19:08:53.062Z'
epss: 0.00261
epssPercentile: 0.15813
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/daehyuh/CVE-2026-47883'
  checkedAt: '2026-09-25T08:20:59.326Z'
exploitAvailable: true
---

## Overview

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19

## Affected

- `spring_framework >= 6.2.0, < 6.2.20`
- `spring_framework >= 7.0.0, < 7.0.8.1`

## Remediation

Upgrade past the affected range:

- `spring_framework 7.0.8.1`