Skip to main content

Sensitive Cookie with Improper SameSite Attribute in org.springframework:spring-web

CVE-2026-47889

  • org.springframework:spring-web
High
7.5/10

Summary

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the "sameSite" attribute. This issue affects Spring Framework versions from 6.2.0 through 6.2.19 and 7.0.0 through 7.0.8.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-1275 - Sensitive Cookie with Improper SameSite Attribute

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

References

Advisory Timeline

  • Published