Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events
    (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from
    6.1.0 through 6.1.25, from 5.3.0 through 5.3.46. (CVE-2026-22735)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events     (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from     6.1.0 through 6.1.25, from 5.3.0 through 5.3.46. (CVE-2026-22735)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
457575	Echo: multiple org.springframework:spring-web packages: security update to 6.2.17	Tenable Cloud Security	Echo Local Security Checks	Local	low
457575	Echo: multiple org.springframework:spring-web packages: security update to 6.2.17	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
439093	SCA: security update for org.springframework:spring-webflux, org.springframework:spring-webmvc (GHSA-6hcq-hmm3-jj3c)	Tenable Cloud Security	SCA Checks	Local	low
439093	SCA: security update for org.springframework:spring-webflux, org.springframework:spring-webmvc (GHSA-6hcq-hmm3-jj3c)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
303245	Linux Distros Unpatched Vulnerability : CVE-2026-22735	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-22735

low

Tenable Plugins

low

low

low

low

low