Description
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Published: 2026-08-27
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Spring Framework applications that render view fragments into Server‑Sent Events streams can suffer stream corruption. The flaw allows fragments to merge into the continuous flow, potentially altering or destroying intended content. This compromises the integrity of SSE messages sent to clients.

Affected Systems

Affected vendors include Spring; specifically the Spring Framework. The vulnerable releases are Spring Framework 7.0.0 through 7.0.8 and Spring Framework 6.2.0 through 6.2.19.

Risk and Exploitability

No CVSS or EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable by any trusted SSE endpoint that renders view fragments. In the absence of quantitative risk metrics, the threat should be treated as medium‑to‑high until a patch is applied.

Generated by OpenCVE AI on August 27, 2026 at 08:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Spring Framework to a version at or above 7.0.9 or 6.2.20, as released by the vendor
  • Ensure that all view fragments injected into SSE streams are properly escaped and validated to prevent malformed content from corrupting the event stream
  • Configure SSE endpoints to enforce strict content‑type headers and boundary markers, and validate client requests to prevent unauthorized or malformed SSE delivery

Generated by OpenCVE AI on August 27, 2026 at 08:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://spring.io/security/cve-2026-47890 cve-icon cve-icon
History

Thu, 27 Aug 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Spring
Spring spring Framework
Vendors & Products Spring
Spring spring Framework

Thu, 27 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-74
CWE-790

Thu, 27 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
Title Spring Framework Server Sent Event stream corruption while rendering fragments
References

Subscriptions

Spring Spring Framework
cve-icon MITRE

Status: PUBLISHED

Assigner: vmware

Published:

Updated: 2026-08-27T05:21:38.260Z

Reserved: 2026-05-20T10:01:00.477Z

Link: CVE-2026-47890

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-27T06:17:20.120

Modified: 2026-08-27T06:17:20.120

Link: CVE-2026-47890

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T08:45:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-790

    Improper Filtering of Special Elements