CLEANSTART-2026-NI39361: Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)
Published Nov 11, 2026
·Updated
Security vulnerability affects the rundeck package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).
Affected Software
2 affected componentsFixes available
cleanstart/rundeck<6.3.0-r0
6.3.0-r0
cleanstart/rundeck<6.1.0-r4
6.1.0-r4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.3.0-r0 - Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.1.0-r4
Event History
Nov 11, 2026
Advisory Published
via OSV·12:39 AM
Data Sourced
via OSV·12:39 AM
DescriptionSeverityAffected Software