Vulnerability details
CVE-2026-59313
Spring Framework
Server Sent Event stream corruption in Spring MVC functional web framework
CVSS 3.1
9.8Critical
Official description
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.8Critical | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Spring | Spring Framework | 5.3.0 ≤ v ≤ 5.3.49 | CVEProject cvelistV5 (CNA) |
| Spring | Spring Framework | 6.0.0 ≤ v ≤ 6.0.30 | CVEProject cvelistV5 (CNA) |
| Spring | Spring Framework | 6.1.0 ≤ v ≤ 6.1.28 | CVEProject cvelistV5 (CNA) |
| Spring | Spring Framework | 6.2.0 ≤ v ≤ 6.2.19 | CVEProject cvelistV5 (CNA) |
| Spring | Spring Framework | 7.0.0 ≤ v ≤ 7.0.8 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-27
- Last updated
- 2026-08-28
- State
- Published
- Assigner (CNA)
- vmware
Exploit prediction (EPSS)
0.56%
Probability of exploitation in 30 days
47%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')