CVE-2026-59313 Security Details

CVE ID

CVE-2026-59313

CWE

CWE-93

CVE Description

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49

Published

Aug 20, 2026

CVSS Score & Severity

2.1Low

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.564%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/web/servlet/function/SseServerResponse$DefaultSseBuilder.comment(Ljava/lang/String;)Lorg/springframework/web/servlet/function/ServerResponse$SseBuilder;

JVMVulnerable params: 0

org/springframework/web/servlet/function/SseServerResponse$DefaultSseBuilder.writeString(Ljava/lang/String;)V

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT