A vulnerability exists in the Spring Framework’s handling of the Content-Disposition header when untrusted input is incorporated without proper sanitization. The weakness can allow an attacker to inject CRLF characters that split the HTTP response, resulting in the creation of arbitrary headers and alteration of the response body. This flaw is identified as CWE‑113 and also involves improper input validation (CWE‑20).

Vulnerable versions of the Spring Framework include 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and all versions 5.2.25.RELEASE and earlier. All affected releases use the code responsible for constructing the Content-Disposition header and are therefore at risk until a fix is applied.

The CVSS score is not provided in the available data; EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker supplying a malicious file name that is reflected into the Content-Disposition header during a download response. Because the application does not sanitize the input, a crafted file name containing CRLF sequences can split the HTTP response, allowing injection of additional headers and manipulation of the response body. No authentication or privilege escalation is required; any user interacting with the application could be affected.