AIKIDO-2026-620042
spring-web is vulnerable to HTTP Request/Response Splitting
31
Low Risk
This Affects:
spring-webTL;DR
spring-web ContentDisposition can embed CR/LF from an untrusted file name. That splits the HTTP response or an outbound multipart part into extra headers or body content. Servlet and reactive connectors shipped with Spring already reject those characters in response headers, so the response case needs a non-default connector. The patch sanitizes file names used in Content-Disposition.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and a Content-Disposition filename is built from untrusted input on a connector that does not reject CR/LF, or on an outbound multipart part.
Background info
spring-web is vulnerable to HTTP Request/Response Splitting in versions 0.0.1 - 7.0.8.
How to fix this
Upgrade the org.springframework:spring-web library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant