2.6
Low
CVE-2026-22735 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This…
Description
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Foundation 7.0 | 7.0.0 → 7.0.5 | No fix stated |
| Spring Foundation 6.2 | 6.2.0 → 6.2.16 | No fix stated |
| Spring Foundation 6.1 | 6.1.0 → 6.1.25 | No fix stated |
| Spring Foundation 5.3 | 5.3.0 → 5.3.46 | No fix stated |