Feed/CVE-2026-47890
CVE-2026-47890CRITICALCVSS 9.8

Spring Framework Server Sent Event stream corruption while rendering fragments

Published Aug 27, 2026·Updated Oct 7, 2026

NVD Description

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

Affected Packages (2)

org.springframework:spring-webmvcMAVEN
From 6.2.0
Fixed in = 6.2.19
org.springframework:spring-webfluxMAVEN
From 6.2.0
Fixed in = 6.2.19

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free