A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute.
Spring Framework 7.0.0 – 7.0.8
Spring Framework 6.2.0 – 6.2.19
HIGH
Vulnerability intelligence
CVE-2026-47889
CVSS 3.17.5
SeverityHigh
Known exploitedNo
NVD references:
Primary source: NIST National Vulnerability Database