{"id":"CVE-2026-22735","published":"2026-03-19T23:37:35Z","modified":"2026-03-20T14:44:48Z","title":"Server Sent Event stream corruption","vendor":"Spring","product":"Spring Foundation","tier":"tail","description":{"text":"Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.","provenance":"source","from":"CVE.org"},"cvss":{"score":2.6,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00117,"percentile":0.01647,"provenance":"source"},"cwes":[{"id":"CWE-667","name":"Improper Locking"}],"references":[{"url":"https://spring.io/security/cve-2026-22735","tags":[]}],"priority":{"score":2.1,"factors":[{"name":"EPSS percentile","points":0.33},{"name":"CVSS severity","points":1.82}]},"vendorSlug":"spring","affectedVersions":[{"vendor":"Spring","product":"Spring Foundation","versions":[">= 7.0.0, <= 7.0.5",">= 6.2.0, <= 6.2.16",">= 6.1.0, <= 6.1.25",">= 5.3.0, <= 5.3.46"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-webmvc","vulnerableRanges":[">=7.0.0-M1, <7.0.6",">=6.2.0, <6.2.17",">=6.0.0, <=6.1.21",">=5.3.0, <=5.3.39"],"patched":["7.0.6","6.2.17"],"from":["GHSA-6hcq-hmm3-jj3c"],"provenance":"source"},{"ecosystem":"Maven","package":"org.springframework:spring-webflux","vulnerableRanges":[">=7.0.0-M1, <7.0.6",">=6.2.0, <6.2.17",">=6.0.0, <=6.1.21",">=5.3.0, <=5.3.39"],"patched":["7.0.6","6.2.17"],"from":["GHSA-6hcq-hmm3-jj3c"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-13404","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-38816","published":"2024-09-13","fixed":"6.1.13","kev":false},{"cve":"CVE-2024-38819","published":"2024-12-19","fixed":"6.1.14","kev":false},{"cve":"CVE-2025-41242","published":"2025-08-18","fixed":"6.2.10","kev":false,"link":{"from":"CVE-2025-41242","to":"CVE-2026-22735","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-webmvc","fromFixed":"6.2.10","toFixed":"6.2.17","daysApart":213}]}},{"cve":"CVE-2026-22735","published":"2026-03-19","fixed":"7.0.6","kev":false},{"cve":"CVE-2026-22737","published":"2026-03-19","fixed":"7.0.6","kev":false},{"cve":"CVE-2026-22741","published":"2026-04-29","fixed":"7.0.7","kev":false},{"cve":"CVE-2026-22745","published":"2026-04-29","fixed":"7.0.7","kev":false}],"package":"Maven:org.springframework:spring-webmvc"}}