Spring Framework applications that render view fragments into Server‑Sent Events streams can experience stream corruption. The flaw, a combination of weaknesses that allow fragments to merge into the continuous flow, may alter or destroy the intended content. This compromises message integrity and can result in the delivery of malformed or malicious data to clients.

The vulnerability affects the Spring Framework across two major release lines: 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19. All Spring MVC and WebFlux applications built on these versions are potentially impacted.

The CVSS score of 9.8 marks the issue as critical, yet the EPSS score of less than 1 percent indicates a very low likelihood of exploitation at present. The flaw is not listed in the CISA KEV catalog. An attacker could target any SSE endpoint that renders view fragments, manipulating the event stream to deliver corrupt or malicious content. Despite the high severity, the overall risk is moderated by the low reported exploitation probability; however, the threat remains significant until the patch is applied.