PT-2026-82408

CVE-2026-47890

Published

2026-08-27

Updated

2026-10-08

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 7.0.0 through 7.0.8

Description Spring MVC and WebFlux applications are susceptible to stream corruption. This issue occurs specifically when utilizing Server-Sent Events (SSE), a mechanism that allows servers to push real-time updates to web pages, in conjunction with view fragments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Vendors

Affected products

Weakness enumeration

CWE-93: Improper Neutralization of CRLF Sequences (\'CRLF Injection\')

Related identifiers

CVE-2026-47890

GHSA-J9F9-W8PJ-32F8

CLEANSTART-2026-MH81901

CLEANSTART-2026-WP23886

CLEANSTART-2026-ZQ00581