CVE-2026-59313

Affected versions of the `org.springframework:spring-webmvc` package are vulnerable to CRLF Injection because a Server-Sent Events response produced through the functional web framework is written without neutralising the line terminators that delimit events. The `Server-Sent Events` implementation fails to sanitize input values containing carriage return and line feed characters, allowing them to improperly terminate and begin new events. An attacker who controls such a value can inject events of their own construction into a stream, which the subscribing client attributes entirely to the server, potentially leading to unauthorized actions or data manipulation.