CVE-2026-59314: Spring Framework response splitting in ContentDisposition

Q: Which applications are exposed to this issue?

Applications using Spring Framework are exposed when they construct a Content-Disposition header using an untrusted file name. The affected release ranges are Spring Framework 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier.

Q: What must an attacker control to exploit the vulnerability?

An attacker needs to supply a malicious file name that the application uses to build a Content-Disposition header value. The provided information does not indicate that applications are affected unless untrusted input reaches that header construction.

Published Aug 27, 2026

Updated

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Affected Software

6 affected components

Spring Spring Framework>=7.0.0<=7.0.8

Spring Spring Framework>=6.2.0<=6.2.19

Spring Spring Framework>=6.1.0<=6.1.28

Spring Spring Framework>=6.0.0<=6.0.30

Spring Spring Framework>=5.3.0<=5.3.49

Spring Spring Framework<=5.2.25.RELEASE

Event History

Aug 27, 2026

CVE Published

via MITRE·06:04 PM

Data Sourced

via MITRE·06:04 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

Description

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using Spring Framework are exposed when they construct a Content-Disposition header using an untrusted file name. The affected release ranges are Spring Framework 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier.

What must an attacker control to exploit the vulnerability?

An attacker needs to supply a malicious file name that the application uses to build a Content-Disposition header value. The provided information does not indicate that applications are affected unless untrusted input reaches that header construction.