CRLF injection in Spring Framework - CVE-2026-59313
Published: August 31, 2026
Vulnerability details
The vulnerability allows a remote user to corrupt the stream of data sent to other users.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in server-sent event handling in Spring MVC functional web framework when streaming plain text server-sent event messages containing attacker-controlled data. A remote user can provide crafted data that will be streamed to other users to corrupt the stream of data sent to other users.
User interaction is required, and the issue applies only when applications use Spring MVC functional web framework with RouterFunction and ServerResponse.sse() to send plain text rather than a structured format such as JSON.
Affected software
Library Support for Spring
OpenPages for IBM Cloud Pak for Data
Maximo Real Estate and Facilities Management (MREF)
OpenPages Cloud pak for data service version
IBM Sterling Control Center
How to mitigate CVE-2026-59313
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
IBM Sterling Control Center - addressed in versions 6.3.1.0.12, 6.4.2.0.8
Maximo Real Estate and Facilities Management (MREF) - addressed in versions 9.1.16, 9.2.4
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0