springframework:spring-web@1.1-rc2 vulnerabilities
latest version
1.2.6
first published
20 years ago
latest version published
20 years ago
licenses detected
- [1.0-rc1,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the springframework:spring-web package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). The vulnerability exists in the handling of Server-Sent Events (SSE) when streaming plain text data. An attacker can inject crafted data into the event stream, breaking message boundaries and corrupting the stream delivered to other clients. By controlling streamed content, an attacker can manipulate how subsequent events are parsed by the client, potentially altering application state or injecting misleading data. Note: This is only exploitable if the application streams attacker-controlled data via SSE using unstructured/plain-text messages instead of a structured format (e.g., JSON). How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')? A fix was pushed into the | [0,) |