CVE-2026-59313

Spring MVC applications that use the functional web framework (functional endpoints) are vulnerable to stream corruption when serving Server-Sent Events (SSE) responses, a flaw classified as CWE-93 (improper neutralization of CRLF sequences in HTTP headers). The issue is triggered when an application streams SSE through these functional endpoints, corrupting the event stream framing; VMware rates the flaw Critical (CVSS 9.8, network-exploitable with no privileges or user interaction) with high confidentiality, integrity, and availability impact, though the advisory describes the outcome as stream corruption rather than a named attack primitive. Any application built on the affected Spring Framework branches that exposes SSE via functional endpoints is in scope. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS puts 30-day exploitation probability at 0.4%.

What to do: Inventory Spring applications for use of the functional web framework (WebMvc.fn/functional endpoints) with SSE streaming and identify which of the affected branches (5.3.x through 7.0.x) they run. Upgrade each affected branch to a release beyond the last listed affected version per the VMware/Broadcom advisory, since fixes ship after 7.0.8, 6.2.19, 6.1.28, 6.0.30, and 5.3.49. As an interim mitigation, avoid serving SSE through functional endpoints or restrict access to those streaming routes.