Описание
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE
A flaw was found in Spring Framework. This vulnerability allows a header predicate bypass to occur in a pre-flight request within a WebFlux application that uses functional endpoints and is deployed with DispatcherServlet. This bypass could potentially lead to unexpected behavior or security policy circumvention.
Отчет
This vulnerability is rated as Moderate impact because successful exploitation depends on a specific application architecture combining WebFlux functional routing with a traditional servlet-based DispatcherServlet container. The issue only affects header predicate validation during CORS pre-flight transactions, limiting the impact to potential routing misdirection or unauthorized request matching rather than arbitrary code execution or direct compromise. Deployments that do not mix WebFlux functional endpoints into servlet dispatchers remain unaffected.
Меры по смягчению последствий
Applications should avoid relying solely on header-based route predicates (headers(...)) in WebFlux functional endpoint configurations to enforce security-relevant access control, since this bypass allows such guards to be circumvented via a crafted CORS pre-flight request. Combining header predicates with a dedicated authentication/authorization layer (e.g., Spring Security) prevents exploitation of this specific issue. For Red Hat Fuse 7, which is in Extended Life Support Phase 2 and will not receive a fix for this issue, this configuration- based guidance is the only available mitigation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | pki-core:10.6/resteasy | Not affected | ||
| Red Hat Enterprise Linux 8 | pki-deps:10.6/resteasy | Not affected | ||
| Red Hat Enterprise Linux 9 | resteasy | Not affected | ||
| Red Hat Fuse 7 | spring-webflux | Out of support scope | ||
| Red Hat OpenShift Dev Spaces 3.31 | devspaces/openvsx-rhel9 | Fixed | RHSA-2026:90321 | 26.10.2026 |
| Red Hat OpenShift Dev Spaces 3.31 | devspaces/pluginregistry-rhel9 | Fixed | RHSA-2026:90321 | 26.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE
A WebFlux application using functional endpoints and deployed with Dis ...
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
EPSS
6.5 Medium
CVSS3