Executive brief
Spring Framework, a widely-used Java application framework, contains a vulnerability in how it constructs HTTP Content-Disposition headers when handling file names. When an application receives a malicious file name from an attacker, the framework may fail to properly sanitize it before including it in the response header, allowing the attacker to inject additional HTTP headers or content. This could enable attackers to manipulate how browsers display content, perform cache poisoning, or conduct phishing attacks.
Technical details
The vulnerability is an HTTP response splitting attack (CWE-113) in Spring Framework's Content-Disposition header construction logic. When untrusted file name input is used directly to build the Content-Disposition header value without proper validation or escaping, an attacker can inject newline characters (CRLF) to create additional HTTP headers or split the response entirely. The vulnerability affects applications using Spring Framework versions 5.2.25 and earlier through 7.0.8, and requires only network-level access with no authentication required. A successful exploit allows an attacker to manipulate response headers, potentially leading to cache poisoning, cross-site scripting via header injection, or other response manipulation attacks. Patches are available in newer versions of Spring Framework.
Affected products
- Spring Spring Framework 5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8
Timeline
- 2026-08-27: published: CVE-2026-59314 published