CVE-2026-41842
Received Received - Intake
Denial of Service in Spring Framework

Publication date: 2026-06-09

Last updated on: 2026-06-09

Assigner: VMware

Description
Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-09
Last Modified
2026-06-09
Generated
2026-06-09
AI Q&A
2026-06-09
EPSS Evaluated
N/A
NVD
CVE-2026-41842
EUVD
EUVD-2026-35330
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
vmware spring_framework From 5.3.0 (inc) to 5.3.48 (inc)
vmware spring_framework From 6.1.0 (inc) to 6.1.27 (inc)
vmware spring_framework From 6.2.0 (inc) to 6.2.18 (inc)
vmware spring_framework From 7.0.0 (inc) to 7.0.7 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-41842 is a Denial of Service (DoS) vulnerability that affects Spring Framework applications using Spring MVC or Spring WebFlux. It occurs when these applications serve static resources from the file system with versioned resources support enabled.

Attackers can exploit this vulnerability by sending specially crafted requests that slow down the process of resolving static resources. This causes HTTP connections to remain open longer than usual, which can overwhelm the server and lead to a denial of service.

Impact Analysis

This vulnerability can impact you by causing a Denial of Service (DoS) condition on your Spring MVC or WebFlux applications. When exploited, it can slow down resource resolution and keep HTTP connections open, potentially exhausting server resources.

As a result, legitimate users may experience degraded performance or be unable to access the application altogether, leading to downtime and loss of availability.

Mitigation Strategies

The primary mitigation step is to upgrade affected Spring Framework versions to the fixed versions.

  • Upgrade to Spring Framework 7.0.8 (OSS) or 7.0.7.1 (Commercial)
  • Upgrade to Spring Framework 6.2.19 (OSS) or 6.2.18.1 (Commercial)
  • Upgrade to Spring Framework 6.1.28 (Commercial)
  • Upgrade to Spring Framework 5.3.49 (Commercial)

Unsupported versions are also affected and should be upgraded or replaced.

Compliance Impact

The provided information does not specify how this Denial of Service (DoS) vulnerability in Spring Framework affects compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41842. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart