CVE-2026-41842

Analyzed Analyzed - Analysis Complete

Denial of Service in Spring Framework

Publication date: 2026-06-09

Last updated on: 2026-06-27

Assigner: VMware

Description

Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-27

Generated

2026-06-29

AI Q&A

2026-06-09

EPSS Evaluated

2026-06-28

NVD

CVE-2026-41842

EUVD

EUVD-2026-35330

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_framework	From 5.3.0 (inc) to 5.3.49 (exc)
vmware	spring_framework	From 6.1.0 (inc) to 6.1.28 (exc)
vmware	spring_framework	From 6.2.0 (inc) to 6.2.19 (exc)
vmware	spring_framework	From 7.0.0 (inc) to 7.0.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Detection Guidance

There are no public detection methods or specific commands provided to identify this vulnerability on your network or system.

The vulnerability affects Spring MVC and WebFlux applications serving static resources with versioned resource support enabled, causing Denial of Service by slowing resource resolution and keeping HTTP connections open.

The only recommended mitigation is upgrading to fixed versions of the Spring Framework.

Executive Summary

CVE-2026-41842 is a Denial of Service (DoS) vulnerability that affects Spring Framework applications using Spring MVC or Spring WebFlux. It occurs when these applications serve static resources from the file system with versioned resources support enabled.

Attackers can exploit this vulnerability by sending specially crafted requests that slow down the process of resolving static resources. This causes HTTP connections to remain open longer than usual, which can overwhelm the server and lead to a denial of service.

Impact Analysis

This vulnerability can impact you by causing a Denial of Service (DoS) condition on your Spring MVC or WebFlux applications. When exploited, it can slow down resource resolution and keep HTTP connections open, potentially exhausting server resources.

As a result, legitimate users may experience degraded performance or be unable to access the application altogether, leading to downtime and loss of availability.

Mitigation Strategies

The primary mitigation step is to upgrade affected Spring Framework versions to the fixed versions.

Upgrade to Spring Framework 7.0.8 (OSS) or 7.0.7.1 (Commercial)
Upgrade to Spring Framework 6.2.19 (OSS) or 6.2.18.1 (Commercial)
Upgrade to Spring Framework 6.1.28 (Commercial)
Upgrade to Spring Framework 5.3.49 (Commercial)

Unsupported versions are also affected and should be upgraded or replaced.

Compliance Impact

The provided information does not specify how this Denial of Service (DoS) vulnerability in Spring Framework affects compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-41842. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70