CVE-2026-59313CWE-93

CVE-2026-59313

Critical · published August 28, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).

Spring Framework 7.0.0 - 7.0.8

Spring Framework 6.2.0 - 6.2.19

Spring Framework 6.1.0 - 6.1.28

Spring Framework 6.0.0 - 6.0.30

Spring Framework 5.3.0 - 5.3.49

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00564 · 46.1th percentile
Weakness
CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-08-28T00:17Z
Affected products (5)
ProductVersionsFixed in
vmware/spring_framework≥ 5.3.0, ≤ 5.3.49—
vmware/spring_framework≥ 6.0.0, ≤ 6.0.30—
vmware/spring_framework≥ 6.1.0, ≤ 6.1.28—
vmware/spring_framework≥ 6.2.0, ≤ 6.2.19—
vmware/spring_framework≥ 7.0.0, ≤ 7.0.8—
References (1)
https://spring.io/security/cve-2026-59313 · [email protected]
EPSS history
Timeline
  • 27 AUG 17:58Z
    Server Sent Event stream corruption in Spring MVC functional web framework
    cvelistv5