Описание
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
A flaw was found in Spring Framework, affecting its MVC and WebFlux applications. When these applications use Server-Sent Events (SSE) with view fragments, a vulnerability allows for stream corruption. This can lead to unreliable data delivery and potential disruption of services.
Отчет
Stream corruption vulnerability in Spring Framework WebFlux and MVC when rendering Server-Sent Events (SSE) with view fragments allows remote unauthenticated attackers to disrupt stream integrity. Exploitation requires attacker control over streamed data, resulting in malformed SSE responses, application state desynchronization, or cross-user data presentation issues. Attack vector is limited to endpoints explicitly rendering view fragments over SSE channels.
Меры по смягчению последствий
Disable view fragment rendering within Server-Sent Event (SSE) endpoints and emit fully instantiated responses or standardized DTOs instead.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel - HawtIO 4 | spring-webmvc | Affected | ||
| Red Hat OpenShift Dev Spaces 3.31 | devspaces/openvsx-rhel9 | Fixed | RHSA-2026:90321 | 26.10.2026 |
| Red Hat OpenShift Dev Spaces 3.31 | devspaces/pluginregistry-rhel9 | Fixed | RHSA-2026:90321 | 26.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
Spring MVC and WebFlux applications are vulnerable to stream corruptio ...
Spring Framework Server Sent Event stream corruption while rendering fragments
EPSS
6.5 Medium
CVSS3