CVE-2026-59313: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') in Spring Spring Framework

Spring MVC applications using the functional web framework are vulnerable to CRLF Injection due to improper neutralization of CRLF sequences when using Server-Sent Events (SSE). This vulnerability affects Spring Framework versions 5.3.0 through 5.3.49, 6.0.0 through 6.0.30, 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. The issue can cause stream corruption in SSE implementations. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is remotely exploitable without privileges or user interaction and results in high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

The vulnerability allows an attacker to perform CRLF injection in Server-Sent Events streams, potentially leading to stream corruption. The CVSS score of 9.8 indicates critical impact, affecting confidentiality, integrity, and availability of affected applications. Exploitation could allow remote attackers to disrupt or manipulate SSE streams without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is provided in the available data. Users should monitor official Spring Framework advisories for patches addressing this vulnerability. Until a patch is available, consider avoiding or restricting use of the functional web framework's SSE features if feasible.