{"id":"CVE-2026-47890","aliases":["CLSA-2026-1787791991","CLSA-2026-1788201541","CLSA-2026-1788253139","CLSA-2026-1788276305","CLSA-2026-1789703693","CLSA-2026-1789722420","CLSA-2026-1790068919","CLSA-2026-1790069169","EUVD-2026-66858","GHSA-j9f9-w8pj-32f8","ROOT-APP-MAVEN-CVE-2026-47890","UBUNTU-CVE-2026-47890"],"status":"published","title":"Spring Framework Server Sent Event stream corruption while rendering fragments","description":"Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00564,"percentile":0.47221,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-93"],"published":"2026-08-27T00:53:11Z","modified":"2026-11-09T12:49:55Z","fixes":[{"ecosystem":"Maven","package":"org.springframework:spring-webflux","fixed_in":["7.0.9"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.springframework:spring-webmvc","fixed_in":["7.0.9"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"org.springframework:spring-webmvc","fixed_in":["6.2.19-aikido.3","7.0.8-aikido.1","7.0.8-aikido.2","6.2.19-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework:spring-webflux","fixed_in":["6.2.19-aikido.3","6.2.19-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework:spring-webmvc","fixed_in":["6.2.19-root.io.3","7.0.8-root.io.1","7.0.8-root.io.2","6.2.19-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework:spring-webflux","fixed_in":["6.2.19-root.io.3","6.2.19-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"last_affected":"6.2.19"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.8"},{"fixed":"7.0.9"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"last_affected":"6.2.19"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.8"},{"fixed":"7.0.9"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.6"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.6"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.15"},{"fixed":"6.2.15-tuxcare.6"}]}],"versions":["6.2.15","6.2.15-tuxcare.1","6.2.15-tuxcare.2","6.2.15-tuxcare.3","6.2.15-tuxcare.4","6.2.15-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.19"},{"fixed":"6.2.19-tuxcare.1"}]}],"versions":["6.2.19"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.1"},{"fixed":"6.2.1-tuxcare.4"}]}],"versions":["6.2.1","6.2.1-tuxcare.1","6.2.1-tuxcare.2","6.2.1-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.13"},{"fixed":"6.2.13-tuxcare.2"}]}],"versions":["6.2.13","6.2.13-tuxcare.1"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.5"},{"fixed":"6.2.5-tuxcare.1"}]}],"versions":["6.2.5"],"bundled":36},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.12"},{"fixed":"6.2.12-tuxcare.1"}]}],"versions":["6.2.12"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.14"},{"fixed":"6.2.14-tuxcare.1"}]}],"versions":["6.2.14"],"bundled":33},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.3"},{"fixed":"6.2.3-tuxcare.1"}]}],"versions":["6.2.3"],"bundled":32},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"last_affected":"6.2.19"}]}],"versions":["6.2.0","6.2.1","6.2.10","6.2.11","6.2.12","6.2.13","6.2.14","6.2.15","6.2.16","6.2.17","6.2.18","6.2.19","6.2.2","6.2.3","6.2.4","6.2.5","6.2.6","6.2.7","6.2.8","6.2.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.9"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.0.8"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"last_affected":"6.2.19"}]}],"versions":["6.2.0","6.2.1","6.2.10","6.2.11","6.2.12","6.2.13","6.2.14","6.2.15","6.2.16","6.2.17","6.2.18","6.2.19","6.2.2","6.2.3","6.2.4","6.2.5","6.2.6","6.2.7","6.2.8","6.2.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.9"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.0.8"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.19-aikido.3"},{"fixed":"7.0.8-aikido.1"},{"fixed":"7.0.8-aikido.2"},{"fixed":"6.2.19-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.19-aikido.3"},{"fixed":"6.2.19-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.19-root.io.3"},{"fixed":"7.0.8-root.io.1"},{"fixed":"7.0.8-root.io.2"},{"fixed":"6.2.19-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.19-root.io.3"},{"fixed":"6.2.19-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.6.RELEASE-7","3.0.6.RELEASE-8","3.0.6.RELEASE-9","3.0.6.RELEASE-10","3.0.6.RELEASE-11","3.0.6.RELEASE-12","3.0.6.RELEASE-13","3.0.6.RELEASE-13ubuntu0.1~esm1","3.0.6.RELEASE-13ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.13-3","3.2.13-4","3.2.13-5","3.2.13-5ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.11-1","4.3.12-1","4.3.13-2","4.3.14-1","4.3.22-1~18.04","4.3.22-1~18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.22-4","4.3.22-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-1","4.3.30-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]}],"products":[{"vendor":"spring","product":"spring framework"},{"vendor":"vmware","product":"spring framework"},{"vendor":"vmware","product":"spring_framework"}],"references":[{"url":"https://spring.io/security/cve-2026-47890","tags":["Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47890","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j9f9-w8pj-32f8"},{"url":"https://github.com/spring-projects/spring-framework","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-47890","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47890","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-47890","title":"Spring Framework Server Sent Event stream corruption while rendering fragments","description":"Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T05:21:38.26Z","modified":"2026-08-27T14:53:37.162Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-66858","description":"Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T05:21:38Z","modified":"2026-08-27T14:53:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:28.115205Z"}],"ghsa":[{"id":"GHSA-j9f9-w8pj-32f8","title":"Spring Framework Server Sent Event stream corruption while rendering fragments","description":"Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T06:31:34Z","modified":"2026-10-07T13:20:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:41:28.013673Z"}],"nvd":[{"id":"CVE-2026-47890","description":"Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T06:17:20.12Z","modified":"2026-09-02T17:36:58.89Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"GHSA-j9f9-w8pj-32f8","title":"Spring Framework Server Sent Event stream corruption while rendering fragments","description":"Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T06:31:34Z","modified":"2026-10-07T13:30:04.802772884Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"UBUNTU-CVE-2026-47890","description":"Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19","status":"published","published":"2026-08-27T06:17:00Z","modified":"2026-11-09T12:49:55.548318321Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T13:27:33.428057Z"},{"id":"CLSA-2026-1787791991","title":"TuxCare security update for org.springframework (2 CVEs)","description":"TuxCare rebuilt 3 org.springframework packages to address 2 CVEs. Fixed in 6.2.15-tuxcare.6.","status":"published","published":"2026-08-27T00:53:11Z","modified":"2026-10-30T07:30:15.08095949Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788201541","title":"TuxCare security update for org.springframework (17 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 17 CVEs. Fixed in 6.2.19-tuxcare.1.","status":"published","published":"2026-08-31T18:39:01Z","modified":"2026-11-02T19:46:02.876660676Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788253139","title":"TuxCare security update for org.springframework (20 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 20 CVEs. Fixed in 6.2.1-tuxcare.4.","status":"published","published":"2026-09-01T08:58:59Z","modified":"2026-11-02T19:46:02.08031646Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788276305","title":"TuxCare security update for org.springframework (25 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 25 CVEs. Fixed in 6.2.13-tuxcare.2.","status":"published","published":"2026-09-01T15:25:05Z","modified":"2026-11-02T19:46:03.67461284Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1789703693","title":"TuxCare security update for org.springframework (36 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 36 CVEs. Fixed in 6.2.5-tuxcare.1.","status":"published","published":"2026-09-18T03:54:53Z","modified":"2026-11-02T19:46:19.189753568Z","updated_at":"2026-11-02T20:29:28.838259Z"},{"id":"CLSA-2026-1789722420","title":"TuxCare security update for org.springframework (34 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 34 CVEs. Fixed in 6.2.12-tuxcare.1.","status":"published","published":"2026-09-18T09:07:00Z","modified":"2026-11-02T19:46:18.4339041Z","updated_at":"2026-11-02T20:29:28.838259Z"},{"id":"CLSA-2026-1790068919","title":"TuxCare security update for org.springframework (33 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 33 CVEs. Fixed in 6.2.14-tuxcare.1.","status":"published","published":"2026-09-22T09:21:59Z","modified":"2026-11-02T19:46:21.56620398Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1790069169","title":"TuxCare security update for org.springframework (32 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 32 CVEs. Fixed in 6.2.3-tuxcare.1.","status":"published","published":"2026-09-22T09:26:09Z","modified":"2026-11-02T19:46:20.214671354Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-47890","title":"CVE-2026-47890 in org.springframework:spring-webmvc - Patched by Root","description":"Root has patched CVE-2026-47890 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-22T18:31:42Z","modified":"2026-10-22T19:15:03.277394067Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}