CVE-2026-22735

What it actually does

The flaw affects Spring MVC and Spring WebFlux applications that use Server-Sent Events (SSE). Improper validation around SSE handling can allow a low-privileged attacker, under specific conditions and with user interaction, to corrupt the event stream delivered by the application. The assessed impact is limited to integrity of streamed event data; the CVSS vector indicates no direct confidentiality loss or service availability impact.

Why it matters to the business

Applications that rely on SSE for live updates, notifications, dashboards, workflow state, or user-facing event feeds could deliver incorrect or corrupted information to users or downstream components. While the severity is low and exploitation appears difficult, affected Spring Framework versions are common in enterprise Java applications, so organizations should prioritize inventorying exposed SSE usage and upgrading during normal patch cycles, especially for applications where streamed data drives operational decisions.

How an attack unfolds

An attacker first needs access to application functionality that uses Server-Sent Events and must be able to interact with the vulnerable SSE endpoint as a low-privileged user. The attacker then crafts requests or event-related input that reaches Spring MVC or WebFlux SSE processing. Under the right timing and application behavior, the vulnerable framework handling can corrupt the event stream. A victim or consuming client that subscribes to the affected SSE feed may then receive malformed, misleading, or unintended streamed event content. There is no indication from the provided data of public exploit maturity, ransomware use, or known exploitation in the wild.

How to fix it

Upgrade Spring Framework to a version outside the affected ranges: earlier affected lines are 7.0.0 through 7.0.5, 6.2.0 through 6.2.16, 6.1.0 through 6.1.25, and 5.3.0 through 5.3.46. Because no exact fixed versions were provided in the input, use the vendor advisory, package manager metadata, or Spring release notes to select the first patched maintenance release after the affected range for the branch in use. Where immediate upgrade is not possible, review and harden SSE endpoints: restrict access to trusted users, validate and encode all data written to SSE streams, avoid reflecting user-controlled content into event fields, add rate limits, and monitor anomalous SSE request patterns. Applications that do not use SSE are unlikely to be exposed to this specific issue even if they run an affected framework version, but should still be upgraded as part of standard dependency hygiene.

How to confirm the fix worked

Confirm exposure by producing a software bill of materials or dependency tree and checking for affected Spring Framework artifacts in the listed version ranges, especially spring-webmvc, spring-webflux, spring-web, and related Spring Framework modules. Confirm whether the application actually uses SSE by reviewing code for SseEmitter, ResponseBodyEmitter, ServerSentEvent, Flux<ServerSentEvent>, MediaType.TEXT_EVENT_STREAM, or endpoints producing text/event-stream. After remediation, verify the deployed artifact resolves Spring Framework to a non-affected version and run regression tests against SSE endpoints to ensure event ordering, formatting, encoding, and client reconnection behavior remain correct. Validate at runtime by checking application startup logs, dependency manifests, container image contents, or build metadata for the patched Spring Framework version.

Typical attack path

1. Identify an application built on affected Spring Framework versions that exposes SSE functionality.
2. Authenticate or otherwise obtain low-privileged access to an SSE-enabled workflow or endpoint, if access controls are required.
3. Trigger SSE connections and submit crafted input that is processed into or alongside the event stream.
4. Rely on the vulnerable Spring MVC or WebFlux SSE handling to corrupt the stream under specific conditions.
5. Cause subscribed users or client components to receive incorrect, malformed, or misleading streamed data.

How to detect it

There are no known public exploit indicators or named threat actors from the provided data, and exploitation would be application-specific. To assess possible prior exploitation, review HTTP access logs, reverse proxy logs, WAF logs, application logs, and authentication logs for unusual access to endpoints that return text/event-stream. Focus on periods before patching and look for authenticated low-privilege users making repeated or abnormal SSE connections, rapid connect/disconnect cycles, unusual Last-Event-ID values, malformed query parameters, unexpected event names or IDs, and application warnings or exceptions around SSE serialization, response streaming, broken pipes, client aborts, encoder errors, or corrupted event output. Correlate suspicious SSE activity with user reports of incorrect live updates or inconsistent event-feed behavior. Because stream corruption may not leave a unique artifact, detection should combine endpoint access analysis, application error telemetry, and review of event payload generation paths.

What your security team should do

• Inventory applications using Spring Framework versions 7.0.0-7.0.5, 6.2.0-6.2.16, 6.1.0-6.1.25, or 5.3.0-5.3.46.
• Prioritize systems that expose Server-Sent Events over the network, especially internet-facing applications or applications where streamed data affects business decisions.
• Upgrade to the vendor-confirmed patched Spring Framework release for the active branch as part of the next patch window; accelerate if SSE is externally reachable or business-critical.
• If upgrades are delayed, apply compensating controls on SSE endpoints: authentication, authorization, strict input validation, output encoding, and rate limiting.
• Search application code and dependency manifests for SSE usage patterns and affected Spring Framework modules.
• Add monitoring for unusual SSE activity, including high-frequency connections, repeated reconnects, malformed event parameters, and suspicious authenticated access to event-stream endpoints.
• Include SSE stream integrity and client behavior in post-upgrade regression testing.