Spring Framework Stream Corruption Vulnerability in Server-Sent Events

A vulnerability exists in Spring MVC and WebFlux applications that use Server-Sent Events (SSE) to stream data to clients. This issue leads to stream corruption, where an attacker can manipulate the data being sent, potentially disrupting the state or presenting false information to users. The vulnerability affects Spring Framework versions 7.0.0 through 7.0.5, 6.2.0 through 6.2.16, 6.1.0 through 6.1.25, and 5.3.0 through 5.3.46. Older, unsupported versions are also vulnerable.

Impact

Exploitation of this vulnerability can corrupt the data stream sent to users, leading to potential misinformation or state disruption in the application.

Remediation

Users should upgrade to Spring Framework versions 7.0.6, 6.2.17, 6.1.26 (commercial), or 5.3.47 (commercial).