EUVD-2026-67193
GHSA-cqhh-73qg-8434
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify SSE endpoint on functional framework
-
DeliverySend request with CRLF-laced input
-
ExploitBreak/forge SSE event framing
-
ExecutionInject or corrupt streamed events
-
ImpactExpose or manipulate client stream data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization CRLF sequence sanitization
|
| Exploitation Conditions | Exploitation requires the target to be a Spring MVC application using the functional web framework (WebMvc.fn / RouterFunction) that produces Server-Sent Events (text/event-stream) AND reflects attacker-controllable input into those event fields without neutralizing CRLF characters - this SSE-plus-functional-framework combination IS the concrete precondition, not a generic 'specific configuration'. Per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is needed and the vector is network-reachable (AV:N), so an internet-exposed vulnerable endpoint is directly attackable. The principal limiting factor is deployment shape: applications that do not use the functional framework, do not emit SSE, or do not echo untrusted data into event streams are not exploitable, which sharply narrows the real-world attack surface relative to the 9.8 score. |
| Impact | Signals conflict and should be weighed rather than taken at face value. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) implies trivial unauthenticated network exploitation with total confidentiality, integrity and availability loss, yet the description ('stream corruption'), the CWE-93 CRLF class, and the 'Information Disclosure' tag point to a response-integrity / cross-stream data-exposure issue rather than full system compromise - the all-High impact appears inflated for this bug class; verify with the Spring advisory. Counterbalancing the high CVSS, EPSS is very low (0.16%, 6th percentile), there is no CISA KEV listing and no public exploit, indicating no evidence of active or imminent widespread exploitation. Exploitability also depends on a specific precondition (an application must actually expose SSE endpoints built on the functional framework and reflect untrusted data), so despite the 9.8 headline this is a patch-in-normal-cycle priority for most estates, escalating only where internet-facing SSE endpoints echo user input. |
| Exploit ScenarioDerived | An attacker sends a crafted request whose parameters contain embedded CRLF sequences to a Spring MVC functional endpoint that streams those parameters back as Server-Sent Events. The injected newlines break the event framing, allowing the attacker to forge additional SSE events or corrupt the stream delivered to a client, potentially exposing or altering data in the event channel. No public proof-of-concept is currently available, but the low attack complexity (AC:L) means exploitation is straightforward once a reflecting SSE endpoint is identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across Spring Framework 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19 and 7.0.0-7.0.8, where unneutralized CRLF sequences (CWE-93) let an attacker inject into or corrupt the event stream. Reported by VMware/Spring and tagged as Information Disclosure, the flaw can break stream framing and potentially leak or splice data across SSE responses. No public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile), but the vendor-assigned CVSS of 9.8 (all-High impact) sits in tension with the information-disclosure framing and warrants scrutiny.
RemediationAI
Patch available per vendor advisory (https://spring.io/security/cve-2026-59313) - upgrade to the fixed maintenance release for your line as published by Spring; the input does not include exact fixed version numbers, so confirm the precise patched versions (the next patch release above each affected range) directly from the spring.io advisory rather than assuming them. Until you can upgrade, the targeted compensating control is to sanitize/strip CR and LF characters from any untrusted data written into SSE event fields, or temporarily avoid reflecting user-controllable input into SSE streams built on the functional web framework; where an SSE endpoint is not business-critical you can disable or restrict access to it, at the cost of losing real-time push functionality for that feature. Front-line WAF rules blocking CRLF/encoded-newline sequences in request parameters that feed SSE endpoints can reduce exposure but may cause false positives and should not be treated as a substitute for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Spring Framework's functional web endpoint model (WebMvc.fn / RouterFunction handlers) when producing Server-Sent Events, a long-lived text/event-stream response format where each event is delimited by newline characters. CWE-93 (Improper Neutralization of CRLF Sequences) is the root cause: because SSE framing is itself line-oriented, carriage-return/line-feed characters embedded in application-supplied event data are not properly neutralized, so attacker-controlled content can terminate or forge event boundaries, injecting spurious 'data:'/'event:' fields or corrupting the stream. The single CPE (cpe:2.3:a:spring:spring_framework:*) confirms the core framework itself is affected rather than a downstream product, meaning any application that emits SSE via the functional framework and reflects untrusted input into events is potentially exposed.
Know when Spring gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, no auth or interaction (AV:N/AC:L/PR:N/UI:N), but CRLF-driven SSE stream corruption yields limited data exposure and response-integrity impact (C:L/I:L), not availability loss or full compromise.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vmware
Lifecycle Timeline
3DescriptionCVE.org
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49
Executive ViewAI
Spring Framework applications using the functional web framework across versions 5.3.0 through 7.0.8 are vulnerable to Server-Sent Events stream corruption that can leak data between responses (CVE-2026-59313, CVSS 9.8). While real-world exploitation likelihood is low (EPSS 0.2%) with no public exploit currently identified, the high severity rating and widespread Spring adoption in enterprise environments mean affected organizations should inventory their exposure and implement interim controls. Enterprises relying on SSE for sensitive communications should prioritize this assessment.
No vendor-released patch identified at time of analysis. Implement these interim mitigations: disable Server-Sent Events endpoints if not operationally critical; enforce strict input validation and CRLF sequence filtering on all user-controlled data entering SSE streams; deploy Web Application Firewall rules configured to detect and reject CWE-93 CRLF injection attempts; implement logging and alerting on SSE stream framing errors that may indicate exploitation; consider network segmentation to isolate affected services; apply vendor patch immediately upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. Rated critical severi
Access control bypass in SpringBlade v4.5.0 importUser function allows low-privileged users to import sensitive user dat
Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing u
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant
SpringBlade v4.5.0 has an access control flaw in authRoutes allowing low-privileged users to escalate to admin through t
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated at
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Sprin
Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJso
Spring Security Aspects may not correctly locate method security annotations on private methods. Rated critical severity
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input esca
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files
Spring Security fails to properly write HTTP response headers in servlet applications across multiple versions (5.7.0-5.
Exploit-DB