Spring MVC applications using the functional web framework are vulnerable to corruption of Server‑Sent Events (SSE) streams. The flaw arises from a failure to properly isolate event data, allowing multiple events sent concurrently to become malformed or reordered. This can lead to integrity violations in the data delivered to clients, potentially exposing incorrect or tampered information. The weakness is mapped to CWE-93.

The affected vendor is Spring. Affected products include the Spring Framework, specifically versions 5.3.0 through 5.3.49, 6.0.0 through 6.0.30, 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. These versions cover the 5.x, 6.x, and 7.x release lines of the framework.

The CVSS score of 9.8 denotes a critical severity, while the EPSS value of < 1% indicates a very low probability of exploitation at the present moment. The vulnerability is not listed in CISA’s KEV catalog. The exploitation path is not explicitly described, but the likely attack vector is inferred to be an attacker sending crafted SSE data to a Spring MVC application that uses the functional web framework. This step is inferred because the issue manifests when concurrent SSE events are emitted; an attacker with network access could provoke the corrupted stream. No elevated privileges are required, suggesting a remote or local attacker could potentially trigger the behavior if the application exposes SSE endpoints.