Description

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T06:17:20.120Z",
  "pubdate": "2026-08-27T06:17:20.120Z",
  "executiveSummary": "A critical stream corruption vulnerability exists within Spring Framework's Server-Sent Events (SSE) implementation when processing view fragments.\nThis flaw, affecting both Spring MVC and Spring WebFlux, allows for the manipulation or degradation of SSE stream integrity during fragment rendering.\nThe vulnerability type pertains to improper neutralization of data streams, which could lead to unauthorized data injection, desynchronization, or potential application-level denial of service.\nAffected products include Spring Framework 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19.\nThe risk implication is significant for applications relying on continuous server-to-client event streaming, as an attacker capable of influencing view fragment inputs may cause the application to generate malformed SSE payloads.\nExploitation generally requires the attacker to have the ability to interact with the view rendering process, potentially leading to unintended cross-site data exposure or client-side application logic failures.\nNo specific authentication or privilege escalation is inherently required if the vulnerable endpoint is exposed to public network traffic.",
  "technicalDetails": "The vulnerability resides in the way Spring MVC and Spring WebFlux handle the serialization of view fragments within an SSE response context. Server-Sent Events rely on a specific text-based protocol where events are delimited by double newlines, and individual fields are prefix-defined (e.g., 'data:', 'event:', 'id:').\nThe root cause involves a failure in the fragment rendering pipeline to adequately escape or sanitize data when a view fragment is injected into the SSE stream. When the framework attempts to serialize complex objects or fragment models into the SSE event buffer, it fails to account for characters or control sequences that disrupt the protocol's framing mechanism.\nAn attacker can exploit this by injecting crafted input into the model data that will be rendered as part of a view fragment. By introducing newline characters or specific control sequences into the rendered fragment output, the attacker can effectively 'break out' of the intended event scope. This manipulation leads to stream corruption, where the client-side SSE consumer misinterprets the injected payload as a new event, a different field, or an entirely disjoint stream.\nStep-by-step attack flow: 1. The attacker identifies an endpoint utilizing SSE that incorporates user-controllable model attributes or fragment identifiers. 2. The attacker submits a specially crafted payload designed to prematurely terminate or modify the structure of an SSE message when processed by the view engine. 3. Upon rendering the fragment, the Spring framework incorrectly serializes the tainted content into the response body. 4. The underlying HTTP response stream becomes corrupted, causing the client-side EventSource API to parse unintended sequences as valid events. 5. This results in the injection of malicious or arbitrary data structures into the client-side session, potentially disrupting the UI state or triggering unauthorized logic flow in the browser.\nThe affected versions, Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8, are exposed due to missing validation checks in the fragment rendering path that ensure data strictly conforms to the SSE protocol format. This issue exists regardless of the underlying container, as it is a logic flaw in the framework's protocol serialization layer.\nPost-exploitation impact includes the ability to conduct data spoofing, state manipulation within the client browser, or potential protocol-level errors that result in the termination of client connections, effectively causing a local denial of service for that stream."
}