CVE-2026-59314

published 2026-08-27

CVE-2026-59314: Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file…

Priority P4 15 low 3.7 CVSS 3.1

AV N AC H PR N UI N S U C N I L A N

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

Affected

12 ranges

Vendor	Product	Version range	Fixed in
spring	spring_framework	<= 5.2.25.RELEASE	—
spring	spring_framework	5.3.0 – 5.3.49	—
spring	spring_framework	6.0.0 – 6.0.30	—
spring	spring_framework	6.1.0 – 6.1.28	—
spring	spring_framework	6.2.0 – 6.2.19	—
spring	spring_framework	7.0.0 – 7.0.8	—
vmware	spring_framework	<= 5.2.25	—
vmware	spring_framework	5.3.0 – 5.3.49	—
vmware	spring_framework	6.0.0 – 6.0.30	—
vmware	spring_framework	6.1.0 – 6.1.28	—
vmware	spring_framework	6.2.0 – 6.2.19	—
vmware	spring_framework	7.0.0 – 7.0.8	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-113