Spring MVC applications that use the functional web framework can have their Server‑Sent Events (SSE) streams corrupted. The corruption occurs because the framework fails to properly isolate event data, leading to malformed or disordered streams when multiple events are sent concurrently. This flaw can potentially alter the data transmitted to a client, affecting the integrity of the information received. The vulnerability is tied to a data handling weakness and could be exploited to tamper with application output.

The vulnerability affects the Spring Framework. All versions from 5.3.0 through 7.0.8 are listed as impacted, covering 5.3.x through 7.0.x series.

No CVSS score or EPSS estimate is publicly available, and the vulnerability is not listed in CISA’s KEV catalog, so the precise likelihood of exploitation remains uncertain. However, the affected components run in many enterprise web services, so the risk of an attacker manipulating SSE payloads remains non‑negligible. The flaw is local to the application server and does not require elevated privileges, implying an opponent with network access to the server can potentially trigger the corruption by sending crafted requests. As no patch or workaround has been disclosed, the safest response is to correct the code base or upgrade to a fixed version.