CVE-2026-47890: spring spring framework CRLF Injection
CVSS: 9.8v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-47890CGA-35hr-68w8-9mj5CGA-952r-xx52-9mjcCGA-m64j-cf9p-9vj3CGA-v5vr-rfqc-gmm8CGA-vm3j-2jh6-3qjcCGA-x26x-ghcw-r6rwCGA-35qg-fqqw-9w9wCGA-36wm-qhhq-6g68CGA-39w2-gx5f-7848CGA-3f5p-582x-9g5fCGA-3xfh-p93j-rpc4CGA-4crg-xcr3-7fh4CGA-4px4-v6gf-rgj8CGA-6h7p-6vwx-pmqpCGA-6vpx-53c2-cwhjCGA-7386-h3hj-r84hCGA-739c-hhhc-6q83CGA-7c54-v6j6-3fpfCGA-7r8j-rh2p-wg65CGA-83cq-h76x-jv5qCGA-88r2-997f-wq8cCGA-8m92-x26g-6w77CGA-93rc-66r2-mw9vCGA-99j5-5xx6-m45qCGA-9mcv-v22g-6mp5CGA-c56q-qpfv-8jwxCGA-c9q8-7cqq-3rqqCGA-cp4x-fjwg-75ffCGA-f4pp-p74m-w8v4CGA-fj33-mvqx-4p23CGA-g3hf-mggw-62vxCGA-gm2c-2f8m-mgxqCGA-j3h2-p8m7-9892CGA-jp6x-j8r7-mr43CGA-m59w-37hx-26vrCGA-m6xx-x386-jj45CGA-mhrx-2h7g-5h58CGA-mq42-qc4q-mg95CGA-p3rh-whph-pqprCGA-p567-mf9m-74mqCGA-pgg9-xw67-4jx8GHSA-j9f9-w8pj-32f8CGA-w6xq-qrhg-pvxqCGA-qgf6-9mj2-7p8hCGA-qhfv-5jvx-9gg7CGA-r8wg-rffq-vfxxCGA-rcpj-53fr-3vvhCGA-v53h-56gh-jxqfCGA-v8m8-7x5w-2crwCGA-v8p4-34gx-vgpxCGA-w2jm-jxx9-h3hgCGA-x3x6-jpfx-8mhcCGA-xp3c-6gm9-rfh9CGA-jrw3-rrfc-7637CGA-wmcr-r8jq-5vrr
Published 27-08-2026Last modified 27-08-2026
Vulnerability summary
CVE-2026-47890 is a critical (CVSS 9.8) CRLF Injection vulnerability in spring spring framework. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.7% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
0.56%
0%100%
Low · +0.25 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 27-08-2026PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
CVSS metrics
6 scores · 6 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
+0.25 pp
From 0.31% on 19-09-2026
19-09-202619-10-2026
EPSS score0.56%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard20 products
- apache-activemq-6.2All versions (No fix recorded)
- apache-activemq-fips-6.2All versions (No fix recorded)
- apache-nifi-registry-2.11< 2.11.0-r8
- camunda-8.8All versions (No fix recorded)
- camunda-zeebe-8.6All versions (No fix recorded)
Org.springframework2 products
- spring-webflux≥ 6.2.0, ≤ 6.2.19 | ≥ 7.0.0, < 7.0.9
- spring-webmvc≥ 6.2.0, ≤ 6.2.19 | ≥ 7.0.0, < 7.0.9
Wolfi2 products
- thingsboard-tb-mqtt-transport< 4.3.1.5-r8 | All versions (No fix recorded)
- thingsboard-tb-node< 4.3.1.5-r8 | < 4.3.1.5-r6 | All versions (No fix recorded)
Spring1 product
- spring framework≥ 7.0.0, ≤ 7.0.8 | ≥ 6.2.0, ≤ 6.2.19
Ubuntu1 product
- libspring-javaAll versions (No fix recorded)
Vmware1 product
- spring_framework≥ 6.2.0, < 6.2.20 | ≥ 7.0.0, < 7.0.8.1
6 vendors · 27 products
