EUVD-2026-66858
GHSA-j9f9-w8pj-32f8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate SSE endpoint using view fragments
-
ExploitSubmit input with embedded CR/LF payload
-
ExecutionBreak SSE event/field framing (CWE-93)
-
ImpactCorrupt stream and leak cross-response data
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires the target application to actively use Server-Sent Events (SSE, text/event-stream responses) rendered together with Spring view fragments - this specific feature combination is the precondition named in the advisory; ordinary Spring apps that do not stream SSE view fragments are not exposed. Within an affected deployment the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is otherwise needed, so the practical limiting factor is entirely whether the vulnerable SSE-with-view-fragments code path is present and reachable. Affected only on Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8. |
| Impact | Signals conflict and should be weighed rather than taken at face value. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) implies unauthenticated remote full compromise, but the description, the 'Information Disclosure' tag, and CWE-93 all point to stream corruption / cross-response data leakage rather than code execution or availability loss - so the A:H and I:H components look inflated. EPSS is very low (0.15%, 5th percentile) and SSVC records exploitation as 'none', which argues against imminent mass exploitation; however SSVC also marks Automatable: yes and Technical Impact: total, so if a reliable technique emerges it could scale. There is no CISA KEV listing and no POC in the provided data. The practical gate is configuration: only applications actually serving SSE with view fragments are exposed, which materially narrows the population versus 'all Spring apps'. Net: this is a patch-soon item for affected deployments - any operator running the vulnerable SSE-plus-view-fragment pattern should treat it as urgent given the network-reachable, unauthenticated vector - but it is not a drop-everything internet-wide emergency in the way the raw 9.8 alone would suggest. |
| Exploit ScenarioDerived | An attacker identifies a public Spring MVC or WebFlux endpoint that streams Server-Sent Events built from view fragments, then submits input that reaches the fragment content with embedded CR/LF sequences. Because the stream framing is not properly neutralized (CWE-93), the injected newlines break event boundaries and corrupt the SSE stream, potentially causing data intended for one response to surface in another. No public POC is identified at time of analysis, and the network/low-complexity CVSS vector means such a request needs no authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Cross-response information disclosure and stream corruption affects Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8 (both MVC and WebFlux) when applications serve Server-Sent Events (SSE) together with view fragments, letting remote attackers corrupt the event stream and potentially bleed data across responses. No public exploit is identified at time of analysis and CISA has not listed the flaw in KEV; EPSS is low at 0.15% (5th percentile). The vendor-assigned 9.8 rating sits uneasily against the CWE-93 root cause, the 'Information Disclosure' tagging, and the SSVC 'exploitation: none' status, suggesting the paper severity outruns observed real-world risk.
RemediationAI
Upgrade Spring Framework to a fixed release above the affected ranges (i.e., beyond 6.2.19 on the 6.2.x line and beyond 7.0.8 on the 7.0.x line); the exact patched version numbers are not stated in the provided data, so confirm them against the vendor advisory at https://spring.io/security/cve-2026-47890 before pinning - do not assume a specific patch tag. Patch available per vendor advisory (Spring/VMware); no exact fix version is independently confirmed in this input. As a compensating control until patched, disable or avoid serving Server-Sent Events responses that render view fragments (the specific vulnerable pattern), or place affected endpoints behind a reverse proxy that normalizes/strips stray CR/LF in streamed response bodies - with the trade-off that disabling SSE breaks any real-time streaming feature relying on it, and proxy normalization must be validated so it does not itself mangle legitimate event framing. Restrict network exposure of SSE endpoints to trusted clients where feasible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Server-Sent Events is a unidirectional HTTP streaming mechanism where the server pushes a long-lived text/event-stream response composed of newline-delimited 'data:' fields. 'View fragments' are partial server-rendered view outputs Spring can emit incrementally. The root cause is classed as CWE-93 (Improper Neutralization of CRLF Sequences), meaning content written into the SSE stream is not correctly neutralized for CR/LF delimiters; because SSE uses newline framing to separate events and fields, unescaped CR/LF from fragment content can break out of the intended event boundary and corrupt the stream structure. This affects the shared response-writing path in both the servlet (Spring MVC) and reactive (Spring WebFlux) stacks. No CPE strings were supplied in the input, so exact configuration matrices must be confirmed against the Spring advisory rather than derived from CPE.
Know when Spring Framework gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, unauthenticated SSE endpoint (AV:N/PR:N), but impact is cross-response information disclosure with limited integrity and no availability effect, so lower than the input's 9.8.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vmware
Lifecycle Timeline
2DescriptionCVE.org
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
Blast Radius
ecosystem impact- 203 maven packages depend on org.springframework:spring-webflux (26 direct, 178 indirect)
- 1,394 maven packages depend on org.springframework:spring-webmvc (459 direct, 935 indirect)
Ecosystem-wide dependent count for version 6.2.0 and other introduced versions.
Articles & Coverage 1
Executive ViewAI
Spring Framework versions 6.2.0-7.0.8 (MVC and WebFlux) contain a critical vulnerability in Server-Sent Events handling that could enable attackers to corrupt response streams and disclose sensitive data across application responses. Organizations relying on real-time data delivery-particularly in finance, healthcare, and e-commerce-face immediate data exposure and potential service disruption. No vendor patch is currently available, requiring urgent protective deployment.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network isolation-restrict SSE endpoints to known, trusted clients only; (2) WAF rules-filter or block requests with malformed stream headers; (3) Functional restriction-disable SSE for non-critical use cases; (4) Enhanced monitoring-log and alert on unusual response patterns or stream corruption indicators; (5) Vendor watch-continuously monitor Spring Framework security advisories for patch availability and stage immediate upgrade upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Spring Framework
View allSpring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow app
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable e
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16,
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not di
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versio
n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specia
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolutio
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow app
Authorization bypass in Spring Framework WebFlux functional-endpoint applications deployed on DispatcherServlet allows a
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across
Server-side request forgery and remote code execution affect the Spring Framework's XsltView component across the 5.2.x
Exploit-DB