Vmware Spring Foundation up to 5.3.46/6.1.25/6.2.16/7.0.5 locking

Summaryinfo

A vulnerability, which was classified as problematic, was found in Vmware Spring Foundation up to 5.3.46/6.1.25/6.2.16/7.0.5. The affected element is an unknown function. Such manipulation leads to an unknown weakness. This vulnerability is uniquely identified as CVE-2026-22735. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Vmware Spring Foundation up to 5.3.46/6.1.25/6.2.16/7.0.5. It has been rated as problematic. Using CWE to declare the problem leads to CWE-667. The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. Impacted is integrity. CVE summarizes:

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

The advisory is available at spring.io. This vulnerability is handled as CVE-2026-22735 since 01/09/2026. The exploitation is known to be difficult. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 05/15/2026).

The vulnerability scanner Nessus provides a plugin with the ID 303245 (Linux Distros Unpatched Vulnerability : CVE-2026-22735), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.3.47, 6.1.26, 6.2.17 or 7.0.6 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (303245) and CERT Bund (WID-SEC-2026-0796). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• IBM Operational Decision Manager
• VMware Tanzu Spring Framework
• RealObjects PDFreactor

Productinfo

Vendor

• Vmware

Name

• Spring Foundation

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11
• 5.3.12
• 5.3.13
• 5.3.14
• 5.3.15
• 5.3.16
• 5.3.17
• 5.3.18
• 5.3.19
• 5.3.20
• 5.3.21
• 5.3.22
• 5.3.23
• 5.3.24
• 5.3.25
• 5.3.26
• 5.3.27
• 5.3.28
• 5.3.29
• 5.3.30
• 5.3.31
• 5.3.32
• 5.3.33
• 5.3.34
• 5.3.35
• 5.3.36
• 5.3.37
• 5.3.38
• 5.3.39
• 5.3.40
• 5.3.41
• 5.3.42
• 5.3.43
• 5.3.44
• 5.3.45
• 5.3.46
• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 6.1.6
• 6.1.7
• 6.1.8
• 6.1.9
• 6.1.10
• 6.1.11
• 6.1.12
• 6.1.13
• 6.1.14
• 6.1.15
• 6.1.16
• 6.1.17
• 6.1.18
• 6.1.19
• 6.1.20
• 6.1.21
• 6.1.22
• 6.1.23
• 6.1.24
• 6.1.25
• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7
• 6.2.8
• 6.2.9
• 6.2.10
• 6.2.11
• 6.2.12
• 6.2.13
• 6.2.14
• 6.2.15
• 6.2.16
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion