SB2026100609 - IBM Control Center update for Spring Framework

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026100609

SB2026100609 - IBM Control Center update for Spring Framework

Published: October 6, 2026

Security Bulletin ID SB2026100609
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) CRLF injection (CVE-ID: CVE-2026-59313)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to corrupt the stream of data sent to other users.

The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in server-sent event handling in Spring MVC functional web framework when streaming plain text server-sent event messages containing attacker-controlled data. A remote user can provide crafted data that will be streamed to other users to corrupt the stream of data sent to other users.

User interaction is required, and the issue applies only when applications use Spring MVC functional web framework with RouterFunction and ServerResponse.sse() to send plain text rather than a structured format such as JSON.


Remediation

Install update from vendor's website.

References