LOW | MARCH 19, 2026 | CVE-2026-22735
Description
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE).
More precisely, an application can be vulnerable when all the following are true:
- the application is using Spring MVC or Spring WebFlux
- the application is sending streaming data to clients using Server Sent Events (SSE)
- the attacker must have control over data that will be streamed to other users of the application
- the application is not using a structured message format like JSON, but plain text messages instead
When all the conditions above are met, the attacker might corrupt the stream of data sent to other users. Depending on the frontend application logic, this could corrupt state or present malicious information to other users.
Affected Spring Products and Versions
Spring Framework:
- 7.0.0 - 7.0.5
- 6.2.0 - 6.2.16
- 6.1.0 - 6.1.25
- 5.3.0 - 5.3.46
Older, unsupported versions are also vulnerable.
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 7.0.x | 7.0.6 | OSS |
| 6.2.x | 6.2.17 | OSS |
| 6.1.x | 6.1.26 | Commercial |
| 5.3.x | 5.3.47 | Commercial |
No further mitigation steps are necessary.
Credit
This issue was responsibly reported by Gyu-hyeok Lee (g2h).
References
History
- 2026-03-19: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy