AIKIDO-2026-19545
spring-webflux is vulnerable to Information Disclosure
31
Low Risk
This Affects:
spring-webfluxTL;DR
spring-webflux HandshakeWebSocketService can include request headers in exception reasons shown to the client. A failed handshake may therefore leak header values, including sensitive tokens, to the peer. This applies to applications that expose WebSocket handshakes. The patch omits request headers from exception reasons.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the WebFlux application supports WebSocket connections through HandshakeWebSocketService.
Background info
spring-webflux is vulnerable to Information Disclosure in versions 0.0.1 - 7.0.8.
How to fix this
Upgrade the org.springframework:spring-webflux library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant