CRLF injection in Spring Framework - CVE-2026-47890
Published: August 28, 2026
Vulnerability identifier: #VU146225
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47890
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to corrupt the stream of data sent to other users.
The vulnerability exists due to improper neutralization of carriage return line feeds in server-sent event view fragment rendering when streaming attacker-controlled data to clients over server-sent events. A remote user can control data that is streamed to other users to corrupt the stream of data sent to other users.
Exploitation requires the application to use Spring MVC or Spring WebFlux and send view fragments to clients over server-sent events.
Affected software
Spring Framework
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-47890
Install security update from vendor's website.
Spring Framework - addressed in versions 6.2.20, 7.0.8.1, 7.0.9
Library Support for Spring - update to 3.5.19
Library Support for Spring - update to 3.5.19