PT-2026-26454 · Vmware · Spring+3

G2H + 1 · Publicado 2026-03-19 · Atualizado 2026-05-15 · CVE-2026-22735

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Baixa

Vetor base

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spring Foundation versions 5.3.0 through 5.3.46 Spring Foundation versions 6.1.0 through 6.1.25 Spring Foundation versions 6.2.0 through 6.2.16 Spring Foundation versions 7.0.0 through 7.0.5

Description Spring MVC and WebFlux applications are susceptible to stream corruption when utilizing Server-Sent Events (SSE). This issue impacts applications using Spring Foundation.

Recommendations Update to a version beyond 5.3.46 Update to a version beyond 6.1.25 Update to a version beyond 6.2.16 Update to a version beyond 7.0.5

Correção

Improper Locking

Enumeração de Fraquezas

CWE-667

Identificadores relacionados

CLEANSTART-2026-IS05941

CLEANSTART-2026-KT07616

CLEANSTART-2026-MQ18886

CVE-2026-22735

GHSA-6HCQ-HMM3-JJ3C

Produtos afetados

Spring

Spring Foundation

Spring Mvc

Spring Webflux

Referências · 59

• https://github.com/spring-projects/spring-framework · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-MQ18886.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IS05941.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KT07616.json · Nota
• https://twitter.com/cyberbivash/status/2034812191174545454 · Publicação no Twitter
• https://osv.dev/vulnerability/ghsa-8qq5-rm4j-mr97 · Nota
• https://osv.dev/vulnerability/CVE-2025-7962 · Nota
• https://osv.dev/vulnerability/CVE-2026-29145 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22735 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-4926 · Nota
• https://osv.dev/vulnerability/CVE-2025-41254 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22735 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-72hv-8253-57qq · Nota
• https://osv.dev/vulnerability/CVE-2026-24733 · Nota
• https://osv.dev/vulnerability/CVE-2025-8916 · Nota