Information Disclosure Vulnerability in Spring Framework by Pivotal
CVE-2026-41841

5.9MEDIUM

Key Information:

Vendor

Spring

Status
Spring Framework
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41841?

Applications built on Spring MVC and WebFlux are susceptible to Information Disclosure attacks when resolving static resources. This flaw allows unauthorized access to potentially sensitive data, leading to security risks for affected applications. Users of Spring Framework versions ranging from 5.3.0 to 7.0.7 should take necessary actions to mitigate these vulnerabilities through updates and proper configuration.

Affected Version(s)

Spring Framework 7.0.0 < 7.0.7.1

Spring Framework 6.2.0 < 6.2.18.1

Spring Framework 6.1.0 < 6.1.28

References

https://spring.io/security/cve-2026-41841

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.