← Back

CVE-2026-59313

nvd nist
Published: Aug 27, 2026Modified: Aug 31, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49

Affected (5)

Vmware
1 product
Spring Framework
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Framework
From 5.3.0 to 5.3.49
Spring Framework
From 6.0.0 to 6.0.30
Spring Framework
From 6.1.0 to 6.1.28
Spring Framework
From 6.2.0 to 6.2.19
Spring Framework
From 7.0.0 to 7.0.8

Related CWEs

CWE-93
Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.