Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events
    (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 (CVE-2026-47890)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events     (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 (CVE-2026-47890)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Spring Framework installed on the remote host is 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by multiple vulnerabilities:

  - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The     issue applies to the filter variants in both Spring MVC and Spring WebFlux. (CVE-2026-47883)

  - A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the     sameSite attribute. (CVE-2026-47889)

  - Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with     view fragments. An attacker with control over data that will be streamed to other users might corrupt the stream of     data sent to those users. (CVE-2026-47890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
473990	Echo: org.springframework:spring-webflux: security update to 6.2.19+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
473990	Echo: org.springframework:spring-webflux: security update to 6.2.19+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
473844	Chainguard: apache-nifi-registry-2.11: security update to 2.11.0-r8	Tenable Cloud Security	Chainguard Local Security Checks	Local	critical
473844	Chainguard: apache-nifi-registry-2.11: security update to 2.11.0-r8	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	critical
473726	SCA: security update for org.springframework:spring-webflux, org.springframework:spring-webmvc (GHSA-j9f9-w8pj-32f8)	Tenable Cloud Security	SCA Checks	Local	critical
473726	SCA: security update for org.springframework:spring-webflux, org.springframework:spring-webmvc (GHSA-j9f9-w8pj-32f8)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
341768	Linux Distros Unpatched Vulnerability : CVE-2026-47890	Nessus	Misc.	Local	critical
341190	Spring Framework 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-47890

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical