CVE-2026-59313
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Affects Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, and 5.3.0-5.3.49.
Risk Assessment
Stream corruption in SSE can lead to malfunctioning of real-time data transmission, data loss, or potential data integrity attacks.
Recommendation
Update Spring Framework to a patched version and test applications using SSE.
Other vulnerabilities in Spring Framework
See all- CVE-2014-0225High
The Spring Framework versions from 4.0.0 to 4.0.4 and from 3.0.0 to 3.2.8, as well as possibly earlier unsupported versions, did not disable by default the resolution of URI references in a DTD declaration when processing user-provided XML documents. This enabled an XXE attack.
- CVE-2026-59283Critical
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Affects multiple versions of Spring Framework.
- CVE-2026-47892Critical
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.5.RELEASE-5.2.25.RELEASE.
- CVE-2026-47891Critical
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.
- CVE-2026-47890Critical
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Affected versions: Spring Framework 7.0.0-7.0.8 and 6.2.0-6.2.19.
- CVE-2022-22968Medium
In Spring Framework versions 5.3.0-5.3.18, 5.2.0-5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
- CVE-2022-22965CriticalActively exploited
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment; applications deployed as Spring Boot executable jars are not vulnerable to this specific exploit, but the vulnerability is more general in nature.
- CVE-2022-22950Medium
In Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
- CVE-2020-5421Medium
In Spring Framework versions 5.2.0-5.2.8, 5.1.0-5.1.17, 5.0.0-5.0.18, 4.3.0-4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
- CVE-2020-5398High
Spring Framework versions 5.2.x prior to 5.2.3, 5.1.x prior to 5.1.13, and 5.0.x prior to 5.0.16 are vulnerable to a reflected file download (RFD) attack when it sets a Content-Disposition header in the response where the filename attribute is derived from user supplied input.
Original NVD description (English source)
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49
Vulnerability data from NVD (NIST) · CISA KEV · EPSS