External risk intelligence

Spring MVC and WebFlux Stream Corruption Vulnerability with Server-Sent Events.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-47890

Spring MVC and WebFlux are core frameworks for developing public-facing web applications, APIs, and microservices. Server-Sent Events (SSE) are a standard mechanism used to push data from these internet-facing web services to clients, making this vulnerability commonly reachable in standard web deployment patterns.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Spring MVC and WebFlux applications that could allow attackers to corrupt data streams when using a specific feature for real-time communication. The main concern is confirming whether your organization utilizes this specific feature within affected Spring applications.

Data stream corruption risk in certain Spring applications.
Affects commonly used web development frameworks.
Confirm relevance and exposure within your environment.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted requests to a vulnerable Spring application. This could allow them to corrupt data streams, potentially leading to unauthorized access to sensitive information or disruption of services.

Network access required.
Triggered by Server-Sent Events.
Leads to data corruption and potential information disclosure.

Live Threat

Current exploitation, exposure, and threat context

When improperly handled, Server-Sent Events (SSE) within Spring MVC and WebFlux applications could lead to stream corruption, potentially affecting the integrity of data exchanged between the server and clients. This vulnerability may occur when view fragments are utilized in conjunction with SSE.

Application data integrity.
Stream corruption when using SSE.
Unpredictable application behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are primarily responsible for addressing this critical vulnerability affecting Spring MVC and WebFlux applications. The initial step involves identifying all instances of the vulnerable technology, confirming their exposure to the internet, and assessing business criticality to prioritize remediation efforts. Coordination with vendor management may be necessary if third-party applications are impacted.

Application and Platform teams own the issue.
Verify internet-facing applications and business criticality.
Plan and execute vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Spring Framework and why does it matter?

Spring Framework is a foundational platform used by developers to build robust Java-based web applications, microservices, and APIs. It provides the building blocks for handling web requests and managing data flow. Because it is widely used to power both internal systems and public-facing web services, it serves as the backbone for many modern enterprise software environments.

What does CVE-2026-47890 mean for data stream integrity?

This vulnerability is classified as CWE-93, which involves improper neutralization of CRLF sequences. In the context of this CVE, it means that an attacker can inject malicious formatting into data streams. When a Spring application uses Server-Sent Events to push updates, this weakness can corrupt the stream, causing the server to misinterpret the data or expose unintended information to the client.

How is this stream corruption vulnerability triggered?

The flaw is triggered when an application uses Server-Sent Events (SSE) in combination with view fragments. If the application does not properly sanitize the inputs associated with these fragments, an attacker can manipulate the communication stream. Importantly, simply using Spring MVC or WebFlux is not enough to trigger the bug; the specific configuration of utilizing view fragments alongside SSE is a necessary condition.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a likely risk because Spring MVC and WebFlux are standard frameworks for public-facing web services. Since Server-Sent Events are commonly used to push real-time data to users over the internet, many applications running this technology fall into the high-reachability category, making them prime targets for network-based exploitation.

What steps should I take to address CVE-2026-47890?

Start by identifying all applications in your environment that utilize the Spring Framework and determine if they use Server-Sent Events with view fragments. Once you have an inventory of these specific services, assess their internet exposure and business impact. This prioritization helps platform teams decide which systems need immediate attention or architectural changes to isolate the vulnerable communication patterns.

References

spring.io/security/cve-2026-47890

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.