CVE-2026-59314 in Spring Framework
Summary
by MITRE • 08/27/2026
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability described involves a critical flaw in the HTTP response handling mechanisms of the Spring Framework, specifically affecting versions ranging from early releases up to version 7.0.8. This issue stems from how applications utilizing this framework construct Content-Disposition header values when processing file downloads or attachments. The core technical deficiency lies in the insufficient sanitization and validation of untrusted input used as filenames. When a malicious filename containing carriage return (CR) and line feed (LF) characters is processed, these control sequences are not properly escaped or rejected by the application logic before being embedded into the HTTP response headers. This lack of strict input validation allows an attacker to inject additional header lines directly into the HTTP response stream sent back to the client browser.
This specific flaw aligns with CWE-75, which defines Improper Neutralization of Special Elements used in an HTTP Response Splitting attack. By injecting CRLF characters, an adversary can effectively split a single HTTP response into two distinct responses. The first part contains the intended header and potentially some initial body content, while the second part consists entirely of attacker-controlled headers and body data. This capability fundamentally breaks the integrity of the communication channel between the server and the client. It allows for scenarios where malicious scripts or phishing pages can be injected directly into the browser's rendering engine under the trust context of the vulnerable application’s domain.
The operational impact of this vulnerability is severe, primarily enabling Cross-Site Scripting (XSS) attacks through response splitting. An attacker who successfully exploits this flaw can inject arbitrary HTML and JavaScript code that executes in the victim’s browser with the privileges associated with the target website. This facilitates session hijacking, credential theft, defacement, or redirection to malicious sites. Furthermore, because the injected content appears to originate from a trusted domain due to the HTTP response splitting technique, users are less likely to suspect foul play, significantly increasing the success rate of social engineering attacks. The vulnerability also poses risks related to cache poisoning if intermediate proxies do not properly handle the malformed headers, potentially affecting other users accessing cached versions of the compromised pages.
From an offensive security perspective, this exploit maps directly to MITRE ATT&CK technique T1059.007, which covers Command and Scripting Interpreter via JavaScript in web applications, specifically leveraging HTTP response splitting as a vector for injection. The attack requires minimal prerequisites from the attacker’s side; typically, it involves finding an input field that accepts filenames or triggers file download functionality without adequate sanitization. Once such an entry point is identified, crafting a payload with embedded CRLF characters allows the attacker to manipulate the server's output structure. This makes the vulnerability particularly dangerous in applications where users can upload files or specify names for downloaded documents, as these are common features in enterprise web platforms built on Spring Frameworks.
Mitigation strategies must focus on strict input validation and secure coding practices within the application layer using the framework. Developers should ensure that all user-supplied data used to construct HTTP headers is strictly validated against a whitelist of allowed characters, explicitly rejecting control characters such as CR (0x0D) and LF (0x1E). Alternatively, frameworks or libraries providing header construction utilities should be updated to automatically encode or escape special characters. For organizations running the affected versions listed, upgrading to a patched version of the Spring Framework is the most effective remediation step. If immediate patching is not feasible, implementing Web Application Firewall rules that detect and block HTTP responses containing unexpected CRLF sequences in headers can provide temporary protection against exploitation attempts until the underlying code issue is resolved through framework updates or custom input sanitization logic.