Static resource cache poisoning in Spring MVC and WebFlux
Priority LOW 15CWE-524Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 14 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the application is configuring the resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with caching enabled * the application adds support for encoded resources resolution * the resource cache must be empty when the attacker has access to the application When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Partial Spring Framework (VMware): 7.0.7, 6.2.18, 6.1.27 +1org.springframework:spring-webflux (Maven): 7.0.7, 6.2.18+1 more productRed Hat: 14 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Spring Framework | 7.0.0 to before 7.0.7; 6.2.0 to before 6.2.18; 6.1.0 to before 6.1.27; 5.3.0 to before 5.3.48 | 7.0.7, 6.2.18, 6.1.27, 5.3.48 | Patch available | CNA |
| — | org.springframework:spring-webflux (Maven) | 7.0.0 to before 7.0.7 | 7.0.7 | Patch available | GHSA-wg35-8jpf-2xv3 |
| — | org.springframework:spring-webflux (Maven) | 6.2.0 to before 6.2.18 | 6.2.18 | Patch available | GHSA-wg35-8jpf-2xv3 |
| — | org.springframework:spring-webflux (Maven) | 6.1.0 – 6.1.26 | — | No fix listed | GHSA-wg35-8jpf-2xv3 |
| — | org.springframework:spring-webflux (Maven) | up to 5.3.47 | — | No fix listed | GHSA-wg35-8jpf-2xv3 |
| — | org.springframework:spring-webmvc (Maven) | 7.0.0 to before 7.0.7 | 7.0.7 | Patch available | GHSA-wg35-8jpf-2xv3 |
| — | org.springframework:spring-webmvc (Maven) | 6.2.0 to before 6.2.18 | 6.2.18 | Patch available | GHSA-wg35-8jpf-2xv3 |
| — | org.springframework:spring-webmvc (Maven) | 6.1.0 – 6.1.26 | — | No fix listed | GHSA-wg35-8jpf-2xv3 |
| — | org.springframework:spring-webmvc (Maven) | up to 5.3.47 | — | No fix listed | GHSA-wg35-8jpf-2xv3 |
- Spring Framework VendorVMware Affected 7.0.0 to before 7.0.7; 6.2.0 to before 6.2.18; 6.1.0 to before 6.1.27; 5.3.0 to before 5.3.48 Fixed in 7.0.7, 6.2.18, 6.1.27, 5.3.48 Patch available CNA
- org.springframework:spring-webflux (Maven) Vendor— Affected 7.0.0 to before 7.0.7 Fixed in 7.0.7 Patch available GHSA-wg35-8jpf-2xv3
- org.springframework:spring-webflux (Maven) Vendor— Affected 6.2.0 to before 6.2.18 Fixed in 6.2.18 Patch available GHSA-wg35-8jpf-2xv3
- org.springframework:spring-webflux (Maven) Vendor— Affected 6.1.0 – 6.1.26 Fixed in — No fix listed GHSA-wg35-8jpf-2xv3
- org.springframework:spring-webflux (Maven) Vendor— Affected up to 5.3.47 Fixed in — No fix listed GHSA-wg35-8jpf-2xv3
- org.springframework:spring-webmvc (Maven) Vendor— Affected 7.0.0 to before 7.0.7 Fixed in 7.0.7 Patch available GHSA-wg35-8jpf-2xv3
- org.springframework:spring-webmvc (Maven) Vendor— Affected 6.2.0 to before 6.2.18 Fixed in 6.2.18 Patch available GHSA-wg35-8jpf-2xv3
- org.springframework:spring-webmvc (Maven) Vendor— Affected 6.1.0 – 6.1.26 Fixed in — No fix listed GHSA-wg35-8jpf-2xv3
- org.springframework:spring-webmvc (Maven) Vendor— Affected up to 5.3.47 Fixed in — No fix listed GHSA-wg35-8jpf-2xv3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* | before 5.3.48; 6.1.0 to before 6.1.27; 6.2.0 to before 6.2.18; 7.0.0 to before 7.0.7 | Vulnerable | VMware |
- cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions before 5.3.48; 6.1.0 to before 6.1.27; 6.2.0 to before 6.2.18; 7.0.0 to before 7.0.7 Vulnerable ·VMware
Remediation
- Fix · CNA Spring Framework (VMware) Fixed in 7.0.7, 6.2.18, 6.1.27, 5.3.48
- Fix · GHSA-wg35-8jpf-2xv3 org.springframework:spring-webflux (Maven) Fixed in 7.0.7 Advisory →
- Fix · GHSA-wg35-8jpf-2xv3 org.springframework:spring-webflux (Maven) Fixed in 6.2.18 Advisory →
- Fix · GHSA-wg35-8jpf-2xv3 org.springframework:spring-webmvc (Maven) Fixed in 7.0.7 Advisory →
- Fix · GHSA-wg35-8jpf-2xv3 org.springframework:spring-webmvc (Maven) Fixed in 6.2.18 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
VMware Spring Framework 5.3.48, 6.1.27 and 2 more versions
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-18269 CVE-2026-22745 : Denial of service in static resource handling on Windows platformsPriority LOW 30
- TI-2026-18264 Spring Framework DoS with Multipart Temp Files in WebFluxPriority LOW 29
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-22741
- 2026-10-03 Alias added: GHSA-wg35-8jpf-2xv3
References
More VMware Spring Framework vulnerabilities
- TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
- TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
- TI-2020-04444 RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application CVSS 3.1HIGH 7.5
- TI-2018-01180 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
- TI-2016-09283 Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution… CVSS 3.1CRITICAL 9.8
- TI-2014-00050 The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2026-22741 · CVE Program
- CVE-2026-22741 · NVD
- FIRST EPSS
- GHSA-wg35-8jpf-2xv3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-22741 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences