CVE-2026-59281
Description
A flaw was found in Spring MVC and WebFlux applications. When these applications are configured to obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors, they become vulnerable. This vulnerability allows for arbitrary HTML or JavaScript code injection, potentially leading to a reflected cross-site scripting (XSS) attack where an attacker could execute malicious scripts in a user's web browser.
Statement
A cross-site scripting (XSS) vulnerability was found in the Spring Framework EscapedErrors wrapper. In versions 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier, Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML and JavaScript code injection. The EscapedErrors wrapper's no argument accessors return the underlying field errors without escaping them, allowing attackers to inject malicious content that executes when the page is rendered, potentially resulting in reflected cross-site scripting attacks. This vulnerability was introduced in 2006 with Spring Framework 2.0. Red Hat ships Spring Framework version 2.x in Fedora, a community-supported distribution, which is affected by this vulnerability but is out of Red Hat's commercial support scope.
Mitigation
Red Hat does not provide fixes for Spring Framework in Fedora, as it is a community-supported product outside of Red Hat's commercial support scope. Fedora users should monitor upstream Spring Framework releases and community package updates.
For customers using Spring Framework in custom applications or third-party software, the following mitigations are available:
1. Upgrade to Spring Framework 7.0.9 or later if using the 7.0.x line. Note that Spring Framework versions 4.3.x, 5.3.x, 6.1.x, and 6.2.x have reached end-of-life and will not receive public security updates.
2. If immediate upgrade is not possible, reduce exposure by rendering field errors through the per-field getFieldErrors(String field) and getFieldError(String field) accessors, or through getAllErrors(), which are escaped correctly.
3. Alternatively, explicitly HTML-escape the rejectedValue and defaultMessage of each field error in the template rather than relying on the wrapper to perform escaping.
4. Implement Content Security Policy (CSP) headers to provide an additional layer of defense against XSS attacks.
5. Review application code to identify uses of the no-argument Errors.getFieldErrors() or Errors.getFieldError() methods and replace them with the safer per-field accessors.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | N/A | 6.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Understanding the Weakness (CWE)
Access Control,Confidentiality
Technical Impact: Bypass Protection Mechanism; Read Application Data
The most common attack performed with cross-site scripting involves the disclosure of private information stored in user cookies, such as session information. Typically, a malicious user will craft a client-side script, which -- when parsed by a web browser -- performs some activity on behalf of the victim to an attacker-controlled system (such as sending all site cookies to a given E-mail address). This could be especially dangerous to the site if the victim has administrator privileges to manage that site. This script will be loaded and run by each user visiting the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
In some circumstances it may be possible to run arbitrary code on a victim's computer when cross-site scripting is combined with other flaws, for example, "drive-by hacking."
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Read Application Data
The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Some cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running "Active X" controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
