Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N N U N L N 3.7 .0026 15.6 —
AFFECTED Product Versions Fixed Spring Framework 7.0.0 – —
TIMELINE Jul 4 Reserved by vmware Aug 27 Published (CNA: vmware) Aug 31 ENRICHED — CVE-2026-59314 (Spring Framework). Received CVSS 3.7 and CPE data from NVD.
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
| Date | Event | Detail |
|---|---|---|
| July 4, 2026 | Reserved | Reserved by vmware |
| August 27, 2026 | Published | Published (CNA: vmware) |
| August 31, 2026 | ENRICHED | ENRICHED — CVE-2026-59314 (Spring Framework). Received CVSS 3.7 and CPE data from NVD. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Spring | Spring Framework | — | 7.0.0 | — |
Authoritative record: CVE-2026-59314 at cve.org
Vendors: spring
Weaknesses: CWE-113
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-59314 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
