HTTP response splitting in Spring Framework - CVE-2026-59314
Published: August 31, 2026
Vulnerability identifier: #VU146395
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59314
CWE-ID: CWE-113
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to corrupt HTTP headers or multipart body framing.
The vulnerability exists due to improper neutralization of carriage return and line feed sequences in Content-Disposition header handling when processing untrusted file names. A remote attacker can supply a malicious file name to corrupt HTTP headers or multipart body framing.
User interaction is required to trigger exploitation. The issue affects applications that set Content-Disposition values from untrusted input, including use in outbound multipart request parts, and the header-splitting case applies to non-default or legacy connectors that do not reject malicious header characters.
Affected software
Spring Framework
Library Support for Spring
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version
Library Support for Spring
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version
How to mitigate CVE-2026-59314
Install security update from vendor's website.
Spring Framework - addressed in versions 5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0