CVE-2026-47890
published 2026-08-27CVE-2026-47890: Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8…
PriorityP352critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.56%
46.1th percentile
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_framework | 6.2.0 – 6.2.19 | — |
| spring | spring_framework | 7.0.0 – 7.0.8 | — |
| vmware | spring_framework | >= 6.2.0 < 6.2.20 | 6.2.20 |
| vmware | spring_framework | >= 7.0.0 < 7.0.8.1 | 7.0.8.1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
vendor_redhat·2026-08-27·CVSS 9.8
CVE-2026-47890 [CRITICAL] CWE-93 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
A flaw was found in Spring Framework, affecting its MVC and WebFlux applications. When these applications use Server-Sent Events (SSE) with view fragments, a vulnerability allows for stream corruption. This can lead to unreliable data delivery and potential disruption of services.
Statement: Stream corruption vulnerability in Spring Framework WebFlux and MVC when rendering Server-Sent Events (SSE) with view fragments allows remote unauthenticated
VulDB
VMware Spring Framework up to 7.0.8/6.2.19 Server-Sent Events crlf injection (WID-SEC-2026-2955)
vuldb·2026-08-27·CVSS 9.8
CVE-2026-47890 [CRITICAL] VMware Spring Framework up to 7.0.8/6.2.19 Server-Sent Events crlf injection (WID-SEC-2026-2955)
A vulnerability categorized as critical has been discovered in VMware Spring Framework up to 7.0.8/6.2.19. This affects an unknown function of the component Server-Sent Events. The manipulation results in crlf injection.
This vulnerability is identified as CVE-2026-47890. The attack can be executed remotely. There is not any exploit available.
GHSA
Spring Framework Server Sent Event stream corruption while rendering fragments
ghsa·2026-08-27
CVE-2026-47890 [CRITICAL] CWE-93 Spring Framework Server Sent Event stream corruption while rendering fragments
Spring Framework Server Sent Event stream corruption while rendering fragments
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
GHSA
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
ghsa_unreviewed·2026-08-27
CVE-2026-47890 [CRITICAL] CWE-93 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
No detection rules found.
No public exploits indexed.
2026-08-27
Published