CVE-2026-47893

Affected versions of the `org.springframework:spring-webflux` package are vulnerable to Information Disclosure due to request headers being included in the reason phrase of an exception raised while establishing a WebSocket connection. The WebSocket connection failure path exposes header values that should remain confidential, as they are included in the exception's reason phrase sent back to the peer. An attacker who can trigger this failure path can read header content from their own request, potentially revealing sensitive information added by intermediaries in a proxied deployment.