CVE-2026-22735

unknown

Published 2026-03-20 · Modified 2026-03-26

CVSS v3

—

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

CVSS v2

—

VIR risk

—

Description

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Predictions

Exploit likelihood

30%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2026-22735

OS impact

OS	Version	Status
debian	bookworm	affected
debian	bullseye	affected
debian	forky	affected
debian	sid	affected
debian	trixie	affected

Package impact

Ecosystem	Package	Vulnerable	Fixed
Maven	org.springframework:spring-webmvc	`>=7.0.0-M1,<7.0.6`	`7.0.6`
Maven	org.springframework:spring-webmvc	`>=6.2.0,<6.2.17`	`6.2.17`
Maven	org.springframework:spring-webmvc	`>=6.0.0,<=6.1.21`
Maven	org.springframework:spring-webmvc	`>=5.3.0,<=5.3.39`
Maven	org.springframework:spring-webflux	`>=7.0.0-M1,<7.0.6`	`7.0.6`
Maven	org.springframework:spring-webflux	`>=6.2.0,<6.2.17`	`6.2.17`
Maven	org.springframework:spring-webflux	`>=6.0.0,<=6.1.21`
Maven	org.springframework:spring-webflux	`>=5.3.0,<=5.3.39`

References

Verify integrity in audit chain (admin only). AS-IS.