CVE-2026-47884
Fixed in a distro release EPSS <1%CVSS 9.8
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
Products: Spring Framework
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework:spring-webmvc | no fix |
| Maven | org.springframework:spring-webmvc | 7.0.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-activemq-5.19 | 0 |
| Chainguard | apache-activemq-6.2 | 0 |
| Chainguard | apache-activemq-6.3 | 6.3.0-r4 |
| Chainguard | apache-activemq-fips-5.19 | 0 |
| Chainguard | apache-activemq-fips-6.2 | 0 |
| Chainguard | apache-activemq-fips-6.3 | 6.3.0-r4 |
| Chainguard | apache-nifi-registry-2.11 | 2.11.0-r8 |
| Chainguard | camunda-8.10 | 8.10.1-r0 |
| Chainguard | camunda-8.8 | 0 |
| Chainguard | camunda-8.9 | 8.9.22-r1 |
| Chainguard | camunda-8.9 | no fix |
| Chainguard | camunda-zeebe-8.10 | 8.10.1-r0 |
| Chainguard | camunda-zeebe-8.6 | 0 |
| Chainguard | camunda-zeebe-8.7 | 0 |
| Chainguard | camunda-zeebe-8.8 | 0 |
| Chainguard | camunda-zeebe-8.9 | 8.9.22-r1 |
| Chainguard | conductor | 0 |
| Chainguard | conductor-fips | 0 |
| Chainguard | datahub-gms | 1.7.0.1-r3 |
| Chainguard | datahub-gms-fips | 1.7.0.1-r2 |
| Chainguard | geoserver-2.27 | no fix |
| Chainguard | geoserver-2.28 | no fix |
| Chainguard | geoserver-3.0 | 3.0.1-r9 |
| Chainguard | kayenta-2025.4 | no fix |
| Chainguard | kayenta-2026.0 | no fix |
| Chainguard | kayenta-2026.1 | no fix |
| Chainguard | kayenta-2026.2 | no fix |
| Chainguard | kayenta-2026.3 | no fix |
| Chainguard | kayenta-fips-2025.4 | no fix |
| Chainguard | kayenta-fips-2026.0 | no fix |
| Chainguard | kayenta-fips-2026.1 | no fix |
| Chainguard | kayenta-fips-2026.2 | no fix |
| Chainguard | kayenta-fips-2026.3 | no fix |
| Chainguard | nacos | 0 |
| Chainguard | nacos-docker | 0 |
| Chainguard | ontop | no fix |
| Chainguard | ontop-fips | no fix |
| Chainguard | thingsboard-tb-mqtt-transport | 0 |
| Chainguard | thingsboard-tb-node | 0 |
| Debian:12 | libspring-java | no fix |
| Debian:13 | libspring-java | no fix |
| Debian:14 | libspring-java | no fix |
| Ubuntu:26.04:LTS | libspring-java | no fix |
| Ubuntu:26.10 | libspring-java | no fix |
| Ubuntu:Pro:14.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:16.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:18.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:20.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:22.04:LTS | libspring-java | no fix |
| Ubuntu:Pro:24.04:LTS | libspring-java | no fix |
| Wolfi | thingsboard-tb-mqtt-transport | 0 |
| Wolfi | thingsboard-tb-node | 0 |