CRLF injection in Spring Framework - CVE-2026-59313
Published: August 31, 2026
Vulnerability details
The vulnerability allows a remote user to corrupt the stream of data sent to other users.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in server-sent event handling in Spring MVC functional web framework when streaming plain text server-sent event messages containing attacker-controlled data. A remote user can provide crafted data that will be streamed to other users to corrupt the stream of data sent to other users.
User interaction is required, and the issue applies only when applications use Spring MVC functional web framework with RouterFunction and ServerResponse.sse() to send plain text rather than a structured format such as JSON.
Affected software
Library Support for Spring
How to mitigate CVE-2026-59313
Library Support for Spring - update to 3.5.19