CVE-2026-59314: CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Spring Spring Framework

This vulnerability (CVE-2026-59314) involves improper neutralization of CRLF sequences in HTTP headers (CWE-113) within the Spring Framework. Specifically, when applications build the Content-Disposition header using untrusted input such as a malicious file name, an attacker could perform HTTP response splitting. The affected versions span multiple major releases of Spring Framework from 5.2.25.RELEASE and earlier up to 7.0.8. No official patch or remediation level has been provided in the available data. The CVSS vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, resulting in no confidentiality or availability impact but low integrity impact.

The impact is limited to potential HTTP response splitting attacks, which can lead to low integrity issues such as HTTP header injection or manipulation. There is no direct confidentiality or availability impact reported. The vulnerability requires an attacker to supply malicious input that is incorporated into the Content-Disposition header without proper sanitization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should avoid building Content-Disposition headers directly from untrusted input or implement strict input validation and sanitization to neutralize CRLF sequences. Monitor vendor communications for patches or official mitigations.