CVE-2026-47890

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

UBUNTU-CVE-2026-47890

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

CVE-2026-47890

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

CVE-2026-47890 Spring Framework Server Sent Event stream corruption while rendering fragments

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

CVE-2026-47890 Spring Framework Server Sent Event stream corruption while rendering fragments

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

CVE-2026-47890

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

CVE-2026-47890

Spring MVC and WebFlux applications are vulnerable to stream corruption when utilizing Server-Sent Events (SSE) with view fragments. This issue is linked to CWE-93 (Improper Neutralization of CRLF Sequences). Affected software includes Spring Framework versions 7.0.0 - 7.0.8 and 6.2.0 - 6.2.19. T...

EUVD-2026-66858

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

CVE-2026-47890: Improper Neutralization of CRLF Sequences

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

CVE-2026-59313: Improper Neutralization of CRLF Sequences

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

PT-2026-82717

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Descripti...

PT-2026-82408

Name of the Vulnerable Software and Affected Versions Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 7.0.0 through 7.0.8 Description Spring MVC and WebFlux applications are susceptible to stream corruption. This issue occurs specifically when utilizing Server-Sent Events...

CVE-2026-53965 MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service

The MCP PHP SDK Composer package mcp/sdk is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only...

EUVD-2026-66113

The MCP PHP SDK Composer package mcp/sdk is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only...

Security Bulletin: Vulnerability in Spring MVC and WebFlux affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Spring MVC and WebFlux has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional...

CVE-2026-53965: Uncontrolled Resource Consumption

The MCP PHP SDK Composer package mcp/sdk is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only...

cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments

cve-2026-47890 - LOW - Spring Framework Server Sent Event stream corruption while rendering fragments...

Cross-site Scripting (XSS)

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS when sending vi...

Cross-site Scripting (XSS)

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

GHSA-7M52-JW36-44R3 MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...