Low · published August 28, 2026
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
| Product | Versions | Fixed in |
|---|---|---|
| vmware/spring_framework | ≤ 5.2.25 | — |
| vmware/spring_framework | ≥ 5.3.0, ≤ 5.3.49 | — |
| vmware/spring_framework | ≥ 6.0.0, ≤ 6.0.30 | — |
| vmware/spring_framework | ≥ 6.1.0, ≤ 6.1.28 | — |
| vmware/spring_framework | ≥ 6.2.0, ≤ 6.2.19 | — |
| vmware/spring_framework | ≥ 7.0.0, ≤ 7.0.8 | — |