CVE-2026-59314

Affected versions of the `org.springframework:spring-web` package are vulnerable to HTTP Response Splitting due to improper sanitization of the `Content-Disposition` header value. The `Content-Disposition` header is constructed from untrusted input, allowing carriage return and line feed characters to prematurely terminate the header. An attacker who controls the file name used in this header can inject arbitrary headers and a response body, potentially leading to malicious content being delivered to clients.