Description

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE).

More precisely, an application can be vulnerable when all the following are true:

• the application is using Spring MVC or Spring WebFlux
• the application is sending streaming data to clients using Server Sent Events (SSE)
• the attacker must have control over data that will be streamed to other users of the application
• the application is not using a structured message format like JSON, but plain text messages instead

When all the conditions above are met, the attacker might corrupt the stream of data sent to other users. Depending on the frontend application logic, this could corrupt state or present malicious information to other users.

Affected Spring Products and Versions

Spring Framework:

• 7.0.0 - 7.0.5
• 6.2.0 - 6.2.16
• 6.1.0 - 6.1.25
• 5.3.0 - 5.3.46

Older, unsupported versions are also vulnerable.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

This issue was responsibly reported by Gyu-hyeok Lee (g2h).

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N&version=3.1

History

• 2026-03-19: Initial vulnerability report published.