Description

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T06:17:20.470Z",
  "pubdate": "2026-08-27T06:17:20.470Z",
  "executiveSummary": "A security vulnerability exists in Spring Framework's WebFlux functional endpoint handling when integrated with DispatcherServlet, specifically involving the processing of CORS pre-flight requests.\nThe vulnerability manifests as a header predicate bypass, which allows unauthorized requests to circumvent security constraints defined by request header predicates.\nThis flaw impacts a broad range of Spring Framework versions, including 7.0.x, 6.2.x, 6.1.x, 6.0.x, 5.3.x, and 5.2.x lines.\nThe risk implication involves potential security constraint enforcement failures, as malicious actors may bypass designed access controls for functional endpoints.\nExploitation requires the application to use WebFlux functional endpoints in conjunction with DispatcherServlet.\nSuccessful exploitation allows an attacker to bypass header-based predicates during the pre-flight request phase, potentially leading to unauthorized interaction with otherwise protected endpoints.",
  "technicalDetails": "The vulnerability resides in the interaction logic between the WebFlux functional routing infrastructure and the DispatcherServlet. In Spring Framework, header predicates are often employed as a security mechanism to restrict access to specific routes based on the presence or values of HTTP request headers.\nDuring a CORS pre-flight request (OPTIONS request), the framework must evaluate whether the incoming request meets the specified routing predicates. The flaw occurs because the underlying mechanism fails to correctly validate or apply these header predicates during the pre-flight dispatch cycle when using the functional programming model routed through the DispatcherServlet.\nThe root cause is a failure in the routing predicate evaluation logic within the request dispatch lifecycle. When a pre-flight request is issued, the framework processes the request through the HandlerMapping chain. If the functional endpoint is protected by a header predicate, the discrepancy in how the DispatcherServlet handles pre-flight requests versus standard requests causes the routing engine to treat the pre-flight request as a match even if the required headers (which are usually sent in the actual request, not the pre-flight request) are absent or do not conform to the predicate requirements.\nAttack flow: An attacker identifies an endpoint protected by a functional header predicate (e.g., a specific custom header required for access). The attacker then crafts a malicious CORS pre-flight OPTIONS request intended for this endpoint. Due to the flaw in the DispatcherServlet integration, the framework erroneously deems the pre-flight request as satisfying the routing predicate. This can permit the request to proceed through the handler chain without the necessary validation.\nThis vulnerability effectively neuters the intended security posture of the application's routing layer. By bypassing these predicates, an attacker may trigger subsequent application logic or expose internal state that was intended to be guarded by these functional predicates. The impact is essentially an authorization bypass, where the security constraint is ignored by the routing logic during the critical pre-flight phase, allowing the request to reach components that assume the header predicate has already been enforced.\nAffected versions include: Spring Framework 7.0.0 - 7.0.8, 6.2.0 - 6.2.19, 6.1.0 - 6.1.28, 6.0.0 - 6.0.30, 5.3.0 - 5.3.49, and 5.2.5.RELEASE - 5.2.25.RELEASE."
}