CVSS 9.8, but the code doesn't add up. CVE-2026-47890 and CVE-2026-59313 in Spring claim critical impact, but: ❌Same root cause: a stray \r corrupting an SSE stream ❌Spring scores both 2.6, Low, same vector ❌CISA scores both 9.8, Critical, no server-side compromise possible And it's not an isolated case: of 6 Critical-rated Spring CVEs published the same day, only 1 holds up against Spring's own advisory. ⚠️Don't take a CISA score at face value. Verify against the vendor advisory before patching or prioritizing. Read our full analysis:https://research.jfrog.com/post/when-critical-loses-context-spring-cves/
Post summary
The analysis counters CISA’s high CVSS scores for CVE‑2026‑47890 and CVE‑2026‑59313, citing Spring’s own low ratings and explaining that the alleged critical impact is unfounded.