daehyuh/cve-2026-47883Minimal proof-of-concept for Spring Framework UrlHandlerFilter open redirect (CVE-2026-47883), demonstrating crafted double-slash requests produce attacker-controlled Location headers.
This repository is a minimal reproduction PoC for CVE-2026-47883, published as an official Spring security advisory.
Spring Framework Open Redirect in UrlHandlerFilter5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)CWE-601 — URL Redirection to Untrusted Site (Open Redirect)Configuring Spring Framework's UrlHandlerFilter with a very broad pattern and redirect mode can produce a Location header pointing to an external origin, resulting in an open redirect. The official Spring advisory lists both the Spring MVC and Spring WebFlux filter variants as affected.
In this PoC's Servlet path, the redirect location is derived from the request URI after removing its trailing slash and is used in the response header.
String location = trimTrailingSlash(request.getRequestURI());
response.setHeader(HttpHeaders.LOCATION, location);
If the raw request URI is //attacker.example/, the result is //attacker.example. Under RFC 3986 §4.2, //attacker.example is a network-path reference, so a browser can interpret it as an external address that preserves the current scheme (e.g., https://attacker.example).
This PoC uses the following conditions.
UrlHandlerFilter is registered in redirect mode./** is applied.// to the server.UrlHandlerFilter.trailingSlashHandler("/**")
.redirect(HttpStatus.PERMANENT_REDIRECT)
.build();
Affected artifacts per the official advisory:
org.springframework:spring-webmvcorg.springframework:spring-webfluxAffected versions:
7.0.0 - 7.0.86.2.0 - 6.2.19Fixed versions:
| Fixed version | Availability |
|---|---|
7.0.9 | OSS |
7.0.8.1 | Enterprise Support Only |
6.2.20 | Enterprise Support Only |
UrlHandlerFilterBootServletIntegrationTest (primary reproduction)Starts an actual Spring Boot + embedded Tomcat application and registers the following filter.
UrlHandlerFilter.trailingSlashHandler("/**")
.redirect(HttpStatus.PERMANENT_REDIRECT)
.build();
Sends requests over a raw TCP socket so that the HTTP client cannot pre-normalize the // path.
embeddedServletContainerEmitsNetworkPathReferenceForDoubleSlashPath
GET //attacker.example/ HTTP/1.1.308 Permanent Redirect and Location: //attacker.example.embeddedServletContainerKeepsExpectedSameOriginRelativeLocationForOrdinaryPath
GET /account/ HTTP/1.1 as a normal control.Location: /account is preserved.UrlHandlerFilterOpenRedirectTest (auxiliary test)Directly verifies the Servlet filter API with mock objects and checks a normal path control.
The Reactive auxiliary test verifies that a specific URI created with MockServerHttpRequest is normalized to /attacker.example. However, this is not an end-to-end reproduction of a raw WebFlux request-target, nor does it mean WebFlux is not affected. The official Spring advisory's affected scope includes both Spring MVC and Spring WebFlux.
Windows:
.\mvnw.cmd test
macOS/Linux:
./mvnw test
Expected results with a vulnerable version:
UrlHandlerFilterBootServletIntegrationTest: Tests run: 2, Failures: 0, Errors: 0, Skipped: 0
UrlHandlerFilterOpenRedirectTest: Tests run: 4, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
A test success means the vulnerable behavior has been reproduced. The primary integration tests generate a Location value from a crafted raw request that can be interpreted as an external origin, while normal requests keep a same-origin relative path.
This repository uses the following combination.
Spring Boot 3.5.14
Spring Framework 6.2.18
Apache Tomcat 10.1.54
Java 17+
Spring Boot and Tomcat are the PoC runtime environment; the officially affected product is Spring Framework. The Spring Framework 6.2.18 used in this PoC falls within the officially affected range 6.2.0 - 6.2.19.
An attacker can trick users into navigating to an external site using a URL of an application they trust. This can be used in phishing, trust relationship abuse, and subsequent credential theft scenarios.
The official CVSS vector requires no prior privileges but requires user interaction, and rates confidentiality and integrity impact as Low and availability impact as None.
Per the official Spring advisory, upgrade to the fixed version appropriate for your support channel. The official advisory states that no additional mitigation is required after upgrading.
The official Spring advisory credits the following.
@daehyuh)