RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

Summary

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

Timeline

1. Jan 16, 2020, 11:55 PM UTCCVE published
2. Oct 8, 2026, 9:10 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 8, 2026, 9:13 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Spring Spring Framework

  From 5.0 · fixed in v5.0.16.RELEASE; From 5.1 · fixed in v5.1.13.RELEASE; From 5.2 · fixed in v5.2.3.RELEASE

• org.springframework:spring-webmvcMaven

  From 5.2.0.RELEASE · fixed in 5.2.3.RELEASE

• org.springframework:spring-webmvcMaven

  From 5.1.0.RELEASE · fixed in 5.1.13.RELEASE

• org.springframework:spring-webmvcMaven

  From 5.0.0.RELEASE · fixed in 5.0.16.RELEASE

• org.springframework:spring-webfluxMaven

  From 5.2.0.RELEASE · fixed in 5.2.3.RELEASE

• org.springframework:spring-webfluxMaven

  From 5.1.0.RELEASE · fixed in 5.1.13.RELEASE

• org.springframework:spring-webfluxMaven

  From 5.0.0.RELEASE · fixed in 5.0.16.RELEASE

References 25