CRLF injection in Spring Framework - CVE-2026-59313

 

CRLF injection in Spring Framework - CVE-2026-59313

Published: August 31, 2026


Vulnerability identifier: #VU146400
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59313
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to corrupt the stream of data sent to other users.

The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in server-sent event handling in Spring MVC functional web framework when streaming plain text server-sent event messages containing attacker-controlled data. A remote user can provide crafted data that will be streamed to other users to corrupt the stream of data sent to other users.

User interaction is required, and the issue applies only when applications use Spring MVC functional web framework with RouterFunction and ServerResponse.sse() to send plain text rather than a structured format such as JSON.


Affected software

Spring Framework
Library Support for Spring

How to mitigate CVE-2026-59313

Install security update from vendor's website.

Spring Framework - addressed in versions 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9
Library Support for Spring - update to 3.5.19

External References

Related Security Bulletins