CVE-2026-22735: spring spring foundation Improper Locking
CVSS: 2.6v3.1LowAnalyzed
AliasesUBUNTU-CVE-2026-22735DEBIAN-CVE-2026-22735CGA-362h-qhpq-qwmcCGA-7qh6-4r46-35w6CGA-7r4g-vgcj-q48jCGA-99gj-3r6c-3gq9CGA-cwgq-3fwf-r237CGA-frr5-cq39-w4jqCGA-hxvf-q2p6-4cp6CGA-hxwq-h9v6-j5g4CGA-2frv-fwjq-75qvCGA-2hqr-f34m-66vqCGA-2hr2-7mhh-c68jCGA-3p38-f7q5-c543CGA-3r2h-jq7r-6mprCGA-443c-qfmv-v6f9CGA-46hj-r6j7-x39hCGA-4hxf-xgwj-prwvCGA-4jm3-33g3-c2c4CGA-4jxw-f8fp-c864CGA-4r6p-jvrv-8vc7CGA-4v29-mrvx-8hjcCGA-4wfg-37v4-7wgmCGA-5439-j2r2-7g7cCGA-58g9-4v85-25pvCGA-593r-969g-36gwCGA-5cv5-vgmv-f84rCGA-5f62-gfq7-7c3xCGA-5ffj-2p89-pxr5CGA-5gx7-rpv7-m7rhCGA-5mvv-62h8-x7rwCGA-5x93-xpx9-v774CGA-652p-ph6m-5fc2CGA-6547-286j-j7wpCGA-67v8-9vhv-p68qCGA-72gj-57v5-7jvgCGA-7c8g-rgp5-w4vwCGA-7f4x-jwwp-r9g9CGA-7q4w-j2jm-w3rrCGA-7v28-8vw9-44v2CGA-825p-5hh3-6h5qCGA-8c5f-hj3x-q63gCGA-8g37-vhvv-jw53CGA-8gph-73h7-g75cCGA-8rxv-xhwf-x4phCGA-9636-q96r-5jjwCGA-96r6-cg7x-rh4cCGA-9wfx-8x2c-859gCGA-c773-m6h7-4v65CGA-cf98-p4c8-9m5jCGA-cg4h-mrcc-m7c9CGA-cwh5-w3f8-649xCGA-f535-9q9f-fwrgCGA-f5wc-97xv-34fmCGA-fcgj-f7fm-cvh4CGA-fh29-57gq-hc23CGA-fw4c-4g95-357gCGA-fw83-jv99-4mgwCGA-fwcm-6vfv-873wCGA-fx94-hrf7-f4rfCGA-g27x-3h32-58cgCGA-g3vw-8936-gf4jCGA-ggg9-3rcg-9p2qCGA-gmpv-334p-jc2qCGA-gq5q-5c3x-j9hfCGA-h2xx-wphq-j6wqCGA-h4f5-55c5-8qx4CGA-hrwh-4j7x-f49hCGA-jc2c-vj2x-5p85CGA-jfm7-vc95-2p8fCGA-jqv6-ppx8-39p3CGA-m4r3-fv5v-xwqgCGA-mq29-ph5g-8mrrCGA-mqjf-774f-phcvCGA-p452-p3gg-9wwmCGA-pgw4-3hhw-368fCGA-pw5p-6pwc-hhfjGHSA-6hcq-hmm3-jj3cCGA-px3x-jh98-3gg4CGA-px6m-mpgf-97phCGA-pxjc-5vm4-xgw4CGA-q4rv-wpcg-g6v5CGA-qc7v-j5r4-fqmmCGA-qhh8-32fw-j6qpCGA-qjcm-jgc3-hh7gCGA-qwcc-h233-f694CGA-qxgc-rxq7-826jCGA-r4hj-xp49-j4hfCGA-r77c-4rqj-v7gqCGA-r8jx-gvm6-3xhxCGA-rpqw-97rm-57f2CGA-rr92-p6h8-wp43CGA-rw22-9mgf-4hp8CGA-v8jh-63wp-w7qgCGA-vc53-v3rw-x94qCGA-vgqj-q2q5-ww3vCGA-vv85-f3w5-r67rCGA-vw9h-39mg-cxfmCGA-w384-mj52-gq33CGA-w39h-4v2q-85p7CGA-w7mj-mmjx-q7cfCGA-wj5w-qqr8-77x4CGA-wjgh-5qwc-7hhjCGA-x6qm-6f3m-3h2cCGA-x9cv-h725-v2v8CGA-x9h5-v299-c6r5CGA-xj4v-65hq-q8c3
Published 19-03-2026Last modified 20-03-2026
Vulnerability summary
CVE-2026-22735 is a low (CVSS 2.6) Improper Locking vulnerability in spring spring foundation. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.5% of scored vulnerabilities.
CVSS score
2.6/10
010
Low · v3.1 (CVE.org)EPSS score
0.12%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 19-03-2026PublishedVulnerability first disclosed.
- 20-03-2026Last modifiedVulnerability information updated.
Description
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
CVSS metrics
7 scores · 7 sources · 1 versionLow 2.6Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated2.6LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated2.6LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated2.6LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated2.6LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
- OSV · MavenEcosystem advisory · calculated2.6LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
- NVDNIST2.6LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.12%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
+0.01 pp
From 0.11% on 18-09-2026
18-09-202618-10-2026
EPSS score0.12%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard33 products
- apache-activemq-5.19All versions (No fix recorded)
- apache-activemq-6.1< 6.1.8-r5
- apache-activemq-fips-5.19All versions (No fix recorded)
- apache-activemq-fips-6.1< 6.1.8-r7
- apache-nifi-registry< 2.8.0-r3
Wolfi3 products
- apache-nifi-registry< 2.8.0-r3
- thingsboard-tb-mqtt-transport< 4.3.1.1-r0
- thingsboard-tb-node< 4.3.1.1-r0
Org.springframework2 products
- spring-webflux≥ 7.0.0-M1, < 7.0.6 | ≥ 6.2.0, < 6.2.17 | ≥ 6.0.0, ≤ 6.1.21 | ≥ 5.3.0, ≤ 5.3.39
- spring-webmvc≥ 7.0.0-M1, < 7.0.6 | ≥ 6.2.0, < 6.2.17 | ≥ 6.0.0, ≤ 6.1.21 | ≥ 5.3.0, ≤ 5.3.39
Debian1 product
- libspring-javaAll versions (No fix recorded)
Spring1 product
- spring foundation≥ 7.0.0, ≤ 7.0.5 | ≥ 6.2.0, ≤ 6.2.16 | ≥ 6.1.0, ≤ 6.1.25 | ≥ 5.3.0, ≤ 5.3.46
Ubuntu1 product
- libspring-javaAll versions (No fix recorded)
Vmware1 product
- spring_framework< 5.3.47 | ≥ 6.1.0, < 6.1.26 | ≥ 6.2.0, < 6.2.17 | ≥ 7.0.0, < 7.0.6
7 vendors · 42 products
