Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux
CVE-2026-41841

5.9MEDIUM

Key Information:

What is CVE-2026-41841?

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Spring Framework 7.0.0 < 7.0.8

Spring Framework 6.2.0 < 6.2.19

Spring Framework 6.1.0 < 6.1.28

Score:

5.9

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

CVE-2026-41841 Data