CVE-2026-59314

Spring Framework spring-web is vulnerable to HTTP response splitting when untrusted input is used to build a Content-Disposition header value. An attacker can inject malicious characters via specially crafted file names to break HTTP headers or corrupt the framing of an outbound multipart body. T...

CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption in the ServerResponse.sse process. An attacker who can control the streamed data can inject malformed data into Server-Sent Events, corrupting the stream for other users. Exploitation requires the appli...