CVE-2026-59313

Analyzed Analyzed - Analysis Complete

Stream Corruption in Spring Framework via Server-Sent Events

Publication date: 2026-08-27

Last updated on: 2026-08-31

Assigner: VMware

Description

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59313

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_framework	From 5.3.0 (inc) to 5.3.49 (inc)
vmware	spring_framework	From 6.0.0 (inc) to 6.0.30 (inc)
vmware	spring_framework	From 6.1.0 (inc) to 6.1.28 (inc)
vmware	spring_framework	From 6.2.0 (inc) to 6.2.19 (inc)
vmware	spring_framework	From 7.0.0 (inc) to 7.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability affects Spring MVC applications using the functional web framework with Server-Sent Events (SSE). Attackers can control streamed data, especially plain text messages, causing stream corruption that may lead to state corruption or malicious information being shown to other users.

Detection Guidance

Detecting this vulnerability requires checking if your Spring Framework version falls within the vulnerable ranges. Use commands like 'java -jar your-app.jar --version' or check dependency files (e.g., pom.xml for Maven or build.gradle for Gradle) to identify the Spring Framework version. Compare the version against the affected ranges: 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, or 7.0.0-7.0.8.

Impact Analysis

It can corrupt application state or display malicious content to users. This may disrupt services, expose sensitive data, or allow attackers to manipulate user interactions with the application.

Compliance Impact

The vulnerability could potentially lead to data corruption or unauthorized data exposure in applications streaming sensitive information via Server-Sent Events (SSE). This may impact compliance with GDPR or HIPAA if personal or health data is corrupted or exposed due to stream corruption.

Mitigation Strategies

Upgrade affected Spring Framework versions to fixed releases: 7.0.9 (OSS), 7.0.8.1 (Enterprise), 6.2.20 (Enterprise), 6.1.29 (Enterprise), 6.0.31 (Enterprise), or 5.3.50 (Enterprise). No additional mitigation steps are required.

Hi! I’m here to help you understand CVE-2026-59313. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70