CVSS 9.8, but the code doesn't add up. CVE-2026-47890 and CVE-2026-59313 in Spring claim critical impact, but: ❌Same root cause: a stray \r corrupting an SSE stream ❌Spring scores both 2.6, Low, same vector ❌CISA scores both 9.8, Critical, no server-side compromise possible And it's not an isolated case: of 6 Critical-rated Spring CVEs published the same day, only 1 holds up against Spring's own advisory. ⚠️Don't take a CISA score at face value. Verify against the vendor advisory before patching or prioritizing. Read our full analysis:https://research.jfrog.com/post/when-critical-loses-context-spring-cves/
Post summary
The post argues that the CVE scores inflated by CISA are incorrect, citing that the true vulnerability is a low‑severity stray carriage‑return in an SSE stream, which is not a critical or exploitable flaw.
