CriticalFix available
Spring Framework Server Sent Event stream corruption while rendering fragments
Type: advisorySources: OSV
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
- Products
- org.springframework:spring-webflux, org.springframework:spring-webmvc
- Affected versions
- 6.2.0, 6.2.1, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.2.16, 6.2.17, 6.2.18, 6.2.19, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8
- Fixed versions
- 7.0.9
- CVEs
- CVE-2026-47890
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 04:08 UTC · Revision 1
Source evidence
Spring Framework Server Sent Event stream corruption while rendering fragments
core-osv · Original sourcePublished 27 Aug 2026, 06:31 UTC
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
osv:GHSA-j9f9-w8pj-32f8
org.springframework:spring-webflux
Fixed versions: Not specified
org.springframework:spring-webflux
Fixed versions: 7.0.9
org.springframework:spring-webmvc
Fixed versions: Not specified
org.springframework:spring-webmvc
Fixed versions: 7.0.9
Complete source record
{
"id": "28b28219515d52c2108e5afea488d8bcdf198462a08a4516f1359c2abb86d748",
"url": "https://osv.dev/vulnerability/GHSA-j9f9-w8pj-32f8",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Spring Framework Server Sent Event stream corruption while rendering fragments",
"summary": "Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19",
"evidence": "osv:GHSA-j9f9-w8pj-32f8",
"products": [
{
"name": {
"value": "org.springframework:spring-webflux",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.2.0",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.1",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.10",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.11",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.12",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.13",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.14",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.15",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.16",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.17",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.18",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.19",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.2",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.3",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.4",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.5",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.6",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.7",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.8",
"evidence": "/affected/0/versions"
},
{
"value": "6.2.9",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "org.springframework:spring-webflux",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.0.9",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "7.0.0",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.1",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.2",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.3",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.4",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.5",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.6",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.7",
"evidence": "/affected/1/versions"
},
{
"value": "7.0.8",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "org.springframework:spring-webmvc",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.2.0",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.1",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.10",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.11",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.12",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.13",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.14",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.15",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.16",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.17",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.18",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.19",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.2",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.3",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.4",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.5",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.6",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.7",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.8",
"evidence": "/affected/2/versions"
},
{
"value": "6.2.9",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "org.springframework:spring-webmvc",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.0.9",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "7.0.0",
"evidence": "/affected/3/versions"
},
{
"value": "7.0.1",
"evidence": "/affected/3/versions"
},
{
"value": "7.0.2",
"evidence": "/affected/3/versions"
},
{
"value": "7.0.3",
"evidence": "/affected/3/versions"
},
{
"value": "7.0.4",
"evidence": "/affected/3/versions"
},
{
"value": "7.0.5",
"evidence": "/affected/3/versions"
},
{
"value": "7.0.6",
"evidence": "/affected/3/versions"
},
{
"value": "7.0.7",
"evidence": "/affected/3/versions"
},
{
"value": "7.0.8",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "GHSA-j9f9-w8pj-32f8",
"aliases": [
"CVE-2026-47890",
"GHSA-j9f9-w8pj-32f8"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"last_affected": "6.2.19"
}
]
}
],
"package": {
"name": "org.springframework:spring-webflux",
"purl": "pkg:maven/org.springframework/spring-webflux",
"ecosystem": "Maven"
},
"versions": [
"6.2.0",
"6.2.1",
"6.2.10",
"6.2.11",
"6.2.12",
"6.2.13",
"6.2.14",
"6.2.15",
"6.2.16",
"6.2.17",
"6.2.18",
"6.2.19",
"6.2.2",
"6.2.3",
"6.2.4",
"6.2.5",
"6.2.6",
"6.2.7",
"6.2.8",
"6.2.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-j9f9-w8pj-32f8/GHSA-j9f9-w8pj-32f8.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.9"
}
]
}
],
"package": {
"name": "org.springframework:spring-webflux",
"purl": "pkg:maven/org.springframework/spring-webflux",
"ecosystem": "Maven"
},
"versions": [
"7.0.0",
"7.0.1",
"7.0.2",
"7.0.3",
"7.0.4",
"7.0.5",
"7.0.6",
"7.0.7",
"7.0.8"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-j9f9-w8pj-32f8/GHSA-j9f9-w8pj-32f8.json",
"last_known_affected_version_range": "<= 7.0.8"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"last_affected": "6.2.19"
}
]
}
],
"package": {
"name": "org.springframework:spring-webmvc",
"purl": "pkg:maven/org.springframework/spring-webmvc",
"ecosystem": "Maven"
},
"versions": [
"6.2.0",
"6.2.1",
"6.2.10",
"6.2.11",
"6.2.12",
"6.2.13",
"6.2.14",
"6.2.15",
"6.2.16",
"6.2.17",
"6.2.18",
"6.2.19",
"6.2.2",
"6.2.3",
"6.2.4",
"6.2.5",
"6.2.6",
"6.2.7",
"6.2.8",
"6.2.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-j9f9-w8pj-32f8/GHSA-j9f9-w8pj-32f8.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.9"
}
]
}
],
"package": {
"name": "org.springframework:spring-webmvc",
"purl": "pkg:maven/org.springframework/spring-webmvc",
"ecosystem": "Maven"
},
"versions": [
"7.0.0",
"7.0.1",
"7.0.2",
"7.0.3",
"7.0.4",
"7.0.5",
"7.0.6",
"7.0.7",
"7.0.8"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-j9f9-w8pj-32f8/GHSA-j9f9-w8pj-32f8.json",
"last_known_affected_version_range": "<= 7.0.8"
}
}
],
"modified": "2026-10-07T13:30:04.802772884Z",
"provider": "osv",
"references": [
"https://nvd.nist.gov/vuln/detail/CVE-2026-47890",
"https://github.com/spring-projects/spring-framework",
"https://spring.io/security/cve-2026-47890"
],
"provider_metadata": {
"cwe_ids": [
"CWE-93"
],
"severity": "CRITICAL",
"github_reviewed": true,
"nvd_published_at": "2026-08-27T06:17:20Z",
"github_reviewed_at": "2026-10-07T13:20:36Z"
}
},
"related_cves": [
{
"value": "CVE-2026-47890",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 95063,
"published_at": "2026-08-27T06:31:34+00:00"
}