Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
Weakness
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Spring_framework | Vmware | 6.2.0 (including) | 6.2.20 (excluding) |
| Spring_framework | Vmware | 7.0.0 (including) | 7.0.8.1 (excluding) |
| Red Hat OpenShift Dev Spaces 3.31 | RedHat | devspaces/openvsx-rhel9:1792494821 | * |
| Red Hat OpenShift Dev Spaces 3.31 | RedHat | devspaces/pluginregistry-rhel9:1792495212 | * |