A high-severity information disclosure vulnerability in the Spring Framework allows unauthenticated attackers to potentially access sensitive request headers through error messages.

This vulnerability, categorized as CWE-209, occurs when exception handling logic in WebFlux WebSocket connections includes request headers in error responses. An unauthenticated attacker can trigger these errors to view sensitive information contained within the headers.

The exposure of sensitive request headers can lead to the unauthorized disclosure of authentication tokens, session identifiers, or other private user data. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to data privacy and regulatory compliance, as it allows attackers to potentially hijack user sessions or gain deeper insights into internal application structures without requiring authentication.

Immediate Action: Review the official Spring security advisory for specific patch availability for your version and upgrade to the recommended secure version immediately.

Proactive Monitoring: Review application error logs for frequent or unusual exception patterns, particularly those originating from WebSocket endpoints, which may indicate probing attempts.

Compensating Controls: Implement global error handling policies that sanitize exception messages before they are returned to the client, ensuring that sensitive header information is stripped from all outgoing responses.

Public Exploit Available: No (exploit_available: unknown)

Organizations utilizing Spring WebFlux should treat this vulnerability with high urgency due to the potential for automated exploitation of sensitive data. Administrators must monitor the Spring security portal for patch releases and prioritize the deployment of updates across all affected environments to prevent unauthorized information disclosure.