CVE-2026-22735

LowCVSS 2.6/10Last modified Jun 17, 2026

Description

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Metrics

CVSS 3.1 2.6/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-667

Affected software

VendorProductVersions
SpringSpring Foundation>= 7.0.0, <= 7.0.5; >= 6.2.0, <= 6.2.16; >= 6.1.0, <= 6.1.25; >= 5.3.0, <= 5.3.46

References

Timeline

Published
Mar 20, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-227375.9Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosCVE-2026-227389.8In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A maCVE-2026-227398.6Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to thCVE-2026-22748.5A SSRF and Arbitrary File Read vulnerability in AppSheet Core in Google AppSheet prior to 2025-11-23 allows an authenticated remote attackerCVE-2026-227406.5A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, tempCVE-2026-227413.1Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can CVE-2026-227428.6Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing CVE-2026-227437.5Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled CVE-2026-227447.5In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, strinCVE-2026-227455.3Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an applicCVE-2026-227463.7Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked CVE-2026-227478.1Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN valu