GitHub Advisoryadvisory · Maven

GHSA-6hcq-hmm3-jj3c Spring MVC and WebFlux has Server Sent Event stream corruption

LOW Published 2026-03-20 Modified 2026-03-20 Official page ↗
Aliases
CVE-2026-22735
Ecosystem
Maven
Packages
org.springframework:spring-webmvc, org.springframework:spring-webflux
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-667
Reviewed
2026-03-20

Affected packages

• Maven org.springframework:spring-webmvc: >= 7.0.0-M1, < 7.0.6 → fixed in 7.0.6 • Maven org.springframework:spring-webmvc: >= 6.2.0, < 6.2.17 → fixed in 6.2.17 • Maven org.springframework:spring-webmvc: >= 6.0.0, <= 6.1.21 (no fix yet) • Maven org.springframework:spring-webmvc: >= 5.3.0, <= 5.3.39 (no fix yet) • Maven org.springframework:spring-webflux: >= 7.0.0-M1, < 7.0.6 → fixed in 7.0.6 • Maven org.springframework:spring-webflux: >= 6.2.0, < 6.2.17 → fixed in 6.2.17 • Maven org.springframework:spring-webflux: >= 6.0.0, <= 6.1.21 (no fix yet) • Maven org.springframework:spring-webflux: >= 5.3.0, <= 5.3.39 (no fix yet)

Description

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Related

Alias · CVE (1)

  • CVE-2026-22735 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). vulnerability

Weakness · CWE (1)

  • CWE-667 Improper Locking weakness

References