cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is sending view fragments to clients over Server Sent Events (SSE) the attacker must have control over data that will be streamed to other users of the application When all the conditions above are met, the attacker might corrupt the stream of data sent to other users. Depending on the frontend application logic, thi…

Spring Security Advisoriesで読む