CVE-2026-22735: Spring Framework SSE DOS Vulnerability

CVE-2026-22735 Overview

CVE-2026-22735 is a stream corruption vulnerability affecting Spring MVC and WebFlux applications when using Server-Sent Events (SSE). The vulnerability is classified under CWE-667 (Improper Locking), indicating an issue with improper resource synchronization that can lead to stream data corruption during SSE communication. This vulnerability affects multiple versions of the Spring Foundation framework, potentially impacting applications that rely on real-time event streaming functionality.

Critical Impact
Applications utilizing Server-Sent Events (SSE) for real-time data streaming may experience stream corruption, potentially leading to data integrity issues and unexpected application behavior.

Affected Products

Spring Foundation 7.0.0 through 7.0.5
Spring Foundation 6.2.0 through 6.2.16
Spring Foundation 6.1.0 through 6.1.25
Spring Foundation 5.3.0 through 5.3.46

Discovery Timeline

2026-03-20 - CVE-2026-22735 published to NVD
2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-22735

Vulnerability Analysis

This vulnerability stems from improper locking mechanisms (CWE-667) within the Spring Framework's Server-Sent Events handling code. When multiple threads attempt to write to an SSE stream concurrently, the lack of proper synchronization can result in stream corruption. This affects both Spring MVC and Spring WebFlux applications that implement SSE endpoints for pushing real-time updates to clients.

The vulnerability requires network access and authenticated user interaction to exploit, making it relatively difficult to leverage in practical attack scenarios. The primary impact is on data integrity rather than confidentiality or availability, as corrupted stream data could lead to incorrect information being displayed to users or processed by client applications.

Root Cause

The root cause is improper locking (CWE-667) in the SSE stream handling mechanism. When concurrent requests attempt to write events to the same SSE connection, the framework fails to properly synchronize access to the output stream. This race condition can result in interleaved or malformed event data being sent to connected clients.

Attack Vector

The vulnerability is exploitable over the network by authenticated users who can trigger concurrent SSE writes. An attacker would need to:

Identify an application endpoint using SSE for real-time communication
Trigger multiple simultaneous events that cause concurrent writes to the SSE stream
Exploit the race condition to corrupt the stream data

The complexity of exploitation is high due to the timing-dependent nature of the race condition and the requirement for specific application configurations that expose the vulnerable code path.

Detection Methods for CVE-2026-22735

Indicators of Compromise

Malformed or truncated Server-Sent Events data in client-side application logs
Unexpected parsing errors in client applications consuming SSE streams
Intermittent data corruption in real-time streaming features
Application exceptions related to SSE output stream handling

Detection Strategies

Monitor application logs for exceptions or errors in SSE-related Spring Framework components
Implement client-side validation to detect malformed SSE event data
Use application performance monitoring (APM) tools to track SSE connection anomalies
Review Spring Framework version inventory across all deployed applications

Monitoring Recommendations

Enable detailed logging for Spring MVC and WebFlux SSE handlers
Set up alerts for sudden increases in SSE parsing errors on client applications
Monitor for unusual patterns in concurrent SSE connections to application endpoints
Track Spring Framework versions in use and flag any within the affected ranges

How to Mitigate CVE-2026-22735

Immediate Actions Required

Inventory all applications using Spring Foundation versions 5.3.0 through 5.3.46, 6.1.0 through 6.1.25, 6.2.0 through 6.2.16, or 7.0.0 through 7.0.5
Prioritize applications that utilize Server-Sent Events (SSE) for real-time communication
Review the Spring Security Advisory for CVE-2026-22735 for official guidance
Plan and schedule upgrades to patched Spring Foundation versions

Patch Information

Consult the official Spring Security Advisory for detailed patch information and recommended upgrade paths. Update to the latest patched version of Spring Foundation that addresses this vulnerability:

For Spring Foundation 7.x: Upgrade to version 7.0.6 or later
For Spring Foundation 6.2.x: Upgrade to version 6.2.17 or later
For Spring Foundation 6.1.x: Upgrade to version 6.1.26 or later
For Spring Foundation 5.3.x: Upgrade to version 5.3.47 or later

Workarounds

Implement application-level synchronization for SSE event emission in custom code
Consider temporarily disabling SSE endpoints if not critical to business operations
Use alternative real-time communication mechanisms such as WebSockets until patching is complete
Implement client-side validation and error handling to gracefully manage corrupted SSE data

bash

# Verify current Spring Framework version in Maven project
mvn dependency:tree -Dincludes=org.springframework:spring-*

# Verify current Spring Framework version in Gradle project
./gradlew dependencies --configuration runtimeClasspath | grep spring