CVE-2026-47890

Analyzed Analyzed - Analysis Complete

Stream Corruption in Spring MVC and WebFlux via SSE with View Fragments

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VMware

Description

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47890

EUVD

EUVD-2026-66858

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_framework	From 6.2.0 (inc) to 6.2.20 (exc)
vmware	spring_framework	From 7.0.0 (inc) to 7.0.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability affects Spring MVC and WebFlux applications using Server-Sent Events (SSE) with view fragments. It allows stream corruption when an attacker controls streamed data, potentially corrupting data sent to other users or presenting malicious information.

Detection Guidance

Detection involves checking if your Spring Framework application uses Server-Sent Events (SSE) with view fragments. Inspect application logs for SSE-related errors or corrupted data streams. Verify Spring Framework versions to confirm if they fall within vulnerable ranges (7.0.0-7.0.8 or 6.2.0-6.2.19).

Commands to check Spring Framework version: grep -r "org.springframework" /path/to/dependency or check Maven/Gradle dependency files for version numbers.

Impact Analysis

An attacker could exploit this to corrupt data streams, leading to state corruption or displaying false information to users. This may cause confusion, data integrity issues, or misinformation in applications relying on SSE for real-time updates.

Compliance Impact

The vulnerability could lead to state corruption or malicious information being presented to users, which may result in unauthorized data exposure or manipulation. This could potentially violate compliance requirements under GDPR (data integrity and confidentiality) and HIPAA (integrity and availability of protected health information).

Mitigation Strategies

Upgrade to fixed versions: Spring Framework 7.0.9 (OSS) or 7.0.8.1 (Enterprise Support Only) for 7.0.x, and 6.2.20 (Enterprise Support Only) for 6.2.x. No additional mitigation steps are required.

Hi! I’m here to help you understand CVE-2026-47890. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70