Spring Framework Predictable Session ID in WebSocket Module

published 2026-06-09 5 mo ago modified 2026-07-29 3 mo ago also GHSA-q723-847q-5g8g , EUVD-2026-35325

cvss: 4.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits: 0; none known

IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Patch / fix

fixed in 2 links 4

maven org.springframework:spring-websocket 6.2.19, 7.0.8
Spring Spring Framework 5.3.49, 6.1.28, 6.2.18.1, 7.0.7.1

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 5 mo ago (2026-06-09)

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.8	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub	3.1	4.8	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.springframework:spring-websocket	>=7.0.0, <7.0.8 >=6.2.0, <6.2.19 >=6.1.0, <=6.1.27 <=5.3.48	7.0.8 6.2.19

Affected products

Spring Spring Framework

Classification

Weakness

CWE-330 Use of Insufficiently Random Values

Technology feeds

Spring rss critical rss

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary