This page lists vulnerabilities in third-party components that security scanners may report against Higson 4.2 and that cannot be removed by upgrading the component. Each entry states whether Higson is affected. Vulnerabilities fixed by a component upgrade are listed in the changelog.
CVE-2026-59313 – Spring Framework (spring-webmvc)#
| Component | org.springframework:spring-webmvc 6.2.19 |
| Severity | Low, CVSS 3.1 base score 2.6 according to the vendor (Spring advisory); reported as Critical by some scanners |
| Status | Not affected |
| Justification | vulnerable_code_not_in_execute_path |
| Action required | None |
| Last reviewed | 2026-10-09 |
Justification. The vulnerability can be exploited only when an application uses the Spring MVC
functional web framework (RouterFunction) to send Server-Sent Events with ServerResponse.sse().
Higson Studio 4.2 and Higson Runtime REST 4.2 define no RouterFunction routes and expose no
Server-Sent Events endpoints. The vulnerable code is shipped with the library but is never executed.