Critical Stream Corruption Vulnerability in libspring-java Affects Multiple Debian Releases
Summary
DEBIAN-CVE-2026-59313: Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Affects libspring-java versions 4.3.30-1 – 4.3.30-4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libspring-java is a library that provides the Spring Framework, a powerful framework for building Java applications. It is widely used for developing web applications and microservices. The library supports various features such as dependency injection, aspect-oriented programming, and transaction management. However, recent vulnerabilities have been identified that could compromise the integrity of applications using Server-Sent Events (SSE) within the framework.
Vulnerability Detail
The vulnerability, identified as CVE-2026-59313, affects Spring MVC applications utilizing the functional web framework. It leads to stream corruption when using Server-Sent Events (SSE), which can result in data integrity issues and potential denial of service. The affected versions include Spring Framework 7.0.0 - 7.0.8, 6.2.0 - 6.2.19, 6.1.0 - 6.1.28, 6.0.0 - 6.0.30, and 5.3.0 - 5.3.49. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider disabling Server-Sent Events (SSE) in your application until the package is updated. This can be done by modifying your application configuration to avoid using SSE features.
Conclusion
The CVE-2026-59313 vulnerability poses a significant risk to applications using the libspring-java library, particularly those utilizing Server-Sent Events. It is crucial for developers to update their packages to mitigate this risk and ensure the integrity of their applications.
See every vulnerability recorded for libspring-java →
FAQ
CVE-2026-59313 is a vulnerability in the Spring Framework that affects applications using Server-Sent Events, leading to potential stream corruption.
Affected versions include Spring Framework 7.0.0 - 7.0.8, 6.2.0 - 6.2.19, 6.1.0 - 6.1.28, 6.0.0 - 6.0.30, and 5.3.0 - 5.3.49.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, consider disabling Server-Sent Events in your application as a temporary workaround.
The CVSS score for CVE-2026-59313 is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
