CVE-2026-22735
Stream Corruption in Spring MVC/WebFlux SSE Causes Data Integrity Risk
Publication date: 2026-03-20
Last updated on: 2026-04-23
Assigner: VMware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vmware | spring_framework | to 5.3.47 (exc) |
| vmware | spring_framework | From 6.1.0 (inc) to 6.1.26 (exc) |
| vmware | spring_framework | From 6.2.0 (inc) to 6.2.17 (exc) |
| vmware | spring_framework | From 7.0.0 (inc) to 7.0.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22735 is a vulnerability in Spring MVC and Spring WebFlux applications that use Server-Sent Events (SSE) to stream data to clients.
The vulnerability occurs when an attacker controls the streamed data sent to other users and the application sends plain text messages instead of structured formats like JSON.
Under these conditions, the attacker can corrupt the SSE data stream, which may cause frontend application state corruption or display malicious information to other users.
- Affected Spring Framework versions include 7.0.0 through 7.0.5, 6.2.0 through 6.2.16, 6.1.0 through 6.1.25, and 5.3.0 through 5.3.46.
Mitigation involves upgrading to fixed versions such as 7.0.6, 6.2.17, 6.1.26, or 5.3.47 depending on the branch.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to corrupt the Server-Sent Events data stream in your Spring MVC or WebFlux application.
Such corruption can lead to frontend application state corruption or cause malicious information to be displayed to other users.
The vulnerability does not affect confidentiality or availability but can cause integrity issues in the streamed data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade the affected Spring Framework versions to the fixed releases.
- Upgrade 7.0.x versions to 7.0.6 (Open Source)
- Upgrade 6.2.x versions to 6.2.17 (Open Source)
- Upgrade 6.1.x versions to 6.1.26 (Commercial)
- Upgrade 5.3.x versions to 5.3.47 (Commercial)
No additional mitigation steps are required beyond upgrading.