Description

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T20:17:57.343Z",
  "pubdate": "2026-08-27T20:17:57.343Z",
  "executiveSummary": "A critical stream corruption vulnerability exists within Spring MVC applications utilizing the functional web framework for Server-Sent Events (SSE).\nThe vulnerability allows for the corruption of the data stream, potentially leading to unauthorized data injection, message interleaving, or information disclosure.\nAffected products include Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, and 5.3.0-5.3.49.\nThis vulnerability poses a significant risk to the integrity of real-time communication channels, as attackers may manipulate the stream content delivered to connected clients.\nExploitation generally requires an attacker to influence the input processed by the functional web framework during the SSE stream lifecycle.\nThe impact depends on the context of the application, but it fundamentally compromises the reliability and authenticity of SSE-based data transmissions.",
  "technicalDetails": "The vulnerability originates in the handling of Server-Sent Events (SSE) within the functional web framework component of the Spring MVC module. The root cause pertains to an improper state management or buffering implementation that fails to maintain stream isolation or protocol integrity when processing multiple asynchronous events.\nIn a typical SSE implementation, the server maintains a persistent HTTP connection and pushes data using the 'text/event-stream' content type. The functional web framework's interaction with the response buffer during high-concurrency scenarios or during specific asynchronous event flushes causes inter-request pollution.\nAttack flow typically follows a pattern where an attacker initiates one or more legitimate connections to the SSE endpoint. By sending specifically crafted requests or triggering high-volume events that force a race condition or buffer overflow, the attacker influences the underlying response output stream.\nBecause the framework fails to correctly demarcate data boundaries between concurrent SSE clients or sequential events within the same stream, internal pointers or stream buffers become corrupted. This allows data intended for one client or one specific event field to be leaked, overwritten, or injected into an entirely different client stream context.\nThe vulnerable component is the reactive/functional SSE support layer within the Spring MVC stack. The flaw is not specific to the transport layer (TCP/HTTP) but is localized to the application's serialization and stream writing logic.\nAuthentication and privilege requirements depend on the host application's security configuration; however, the vulnerability is inherently exposed over the network. If an SSE endpoint is publicly accessible, no prior authentication may be required for an attacker to initiate the sequence of events necessary to trigger the stream corruption.\nPost-exploitation impact involves the degradation of application security controls relying on the integrity of real-time event streams. In scenarios where SSE is used for sensitive notifications or state synchronization, an attacker could spoof server events or intercept unauthorized event data. This compromises the 'Trusted Server' model by effectively turning the stream into an untrusted conduit for arbitrary data injection."
}