CVE-2026-59314

Received Received - Intake

HTTP Response Splitting in Spring Framework

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-59314

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_framework	From 7.0.0 (inc) to 7.0.8 (inc)
vmware	spring_framework	From 6.2.0 (inc) to 6.2.19 (inc)
vmware	spring_framework	From 6.1.0 (inc) to 6.1.28 (inc)
vmware	spring_framework	From 6.0.0 (inc) to 6.0.30 (inc)
vmware	spring_framework	From 5.3.0 (inc) to 5.3.49 (inc)
vmware	spring_framework	to 5.2.25 (exc)
spring	framework	From 7.0.0 (inc) to 7.0.8 (inc)
spring	framework	From 6.2.0 (inc) to 6.2.19 (inc)
spring	framework	From 6.1.0 (inc) to 6.1.28 (inc)
spring	framework	From 6.0.0 (inc) to 6.0.30 (inc)
spring	framework	From 5.3.0 (inc) to 5.3.49 (inc)
spring	framework	to 5.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

CVE-2026-59314 is a response splitting vulnerability in the Spring Framework. It occurs when applications build a Content-Disposition header using untrusted input, such as a malicious file name. This can lead to HTTP response splitting attacks.

Detection Guidance

To detect this vulnerability, inspect applications using affected Spring Framework versions for Content-Disposition headers built from untrusted input. Check logs for HTTP response splitting attempts or malformed headers. Use tools like Wireshark to monitor HTTP responses for suspicious patterns in headers.

Impact Analysis

This vulnerability could allow attackers to inject malicious headers or content into responses, potentially leading to phishing attacks, cache poisoning, or session hijacking. It affects applications using vulnerable Spring Framework versions when untrusted input is used for Content-Disposition headers.

Mitigation Strategies

Upgrade to fixed Spring Framework versions: 7.0.9+, 6.2.20+, 6.1.29+, 6.0.31+, 5.3.50+, or 5.2.26+. No additional mitigation is required beyond patching. Verify the upgrade by checking the framework version in use.

Hi! I’m here to help you understand CVE-2026-59314. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70