Skip to main content

Improper Neutralization of CRLF Sequences ('CRLF Injection') in org.springframework:spring-webmvc

CVE-2026-59313

  • org.springframework:spring-webmvc
High
9.8/10

Summary

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Framework versions from 5.3.0 through 5.3.49, 6.0.0 through 6.0.30, 6.1.0 through 6.1.28, 6.2.0 through 6.2.19 and 7.0.0 through 7.0.8.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

References

Advisory Timeline

  • Published