What is the CVSS score of CVE-2026-22741?

CVE-2026-22741 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-22741?

Yes, a patch is available for CVE-2026-22741. Update the affected software to the latest version immediately.

Spring Framework CVE-2026-22741

EUVD-2026-26206 LOW

Use of Cache Containing Sensitive Information (CWE-524)

2026-04-29 vmware

Denial Of Service Java VMware Spring Framework

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

vuln.today AI

3.7 LOW

AC:H captures the four simultaneous prerequisites and cache-empty timing; UI:N because the attacker directly completes the poisoning without requiring a victim's action; A:L for client-side availability loss only.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:58 vuln.today

Patch released

May 04, 2026 - 14:51 nvd

Patch available

CVSS changed

Apr 29, 2026 - 15:22 NVD

3.1 (LOW)

Patch available

Apr 29, 2026 - 13:01 EUVD

EUVD ID Assigned

Apr 29, 2026 - 12:00 euvd

EUVD-2026-26206

CVE Published

Apr 29, 2026 - 11:32 nvd

LOW 3.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.springframework:spring-webflux (5 direct, 1 indirect)
23 maven packages depend on org.springframework:spring-webmvc (14 direct, 9 indirect)

Ecosystem-wide dependent count for version 7.0.0 and other introduced versions.

DescriptionCVE.org

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

More precisely, an application can be vulnerable when all the following are true:

the application is using Spring MVC or Spring WebFlux
the application is configuring the resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with caching enabled
the application adds support for encoded resources resolution
the resource cache must be empty when the attacker has access to the application

When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.

AnalysisAI

Cache poisoning in Spring Framework's static resource handler allows network-accessible unauthenticated attackers to corrupt the resource cache with wrongly-encoded content, causing a denial of service for clients consuming the front-end. Affected are Spring MVC and Spring WebFlux applications across Spring Framework 5.3.x, 6.1.x, 6.2.x, and 7.0.x that explicitly configure the resource chain with both caching and encoded resource resolution enabled. No public exploit exists and no active exploitation has been identified; EPSS at 0.06% (17th percentile) and SSVC exploitation rating of 'none' confirm very low real-world risk at this time.

Technical ContextAI

Spring Framework's resource handling infrastructure supports a configurable 'resource chain' that chains multiple resolvers, including one for pre-encoded static assets (e.g., gzip or brotli variants). CWE-524 (Use of Cache Containing Sensitive Information - improper caching) describes the root cause class: the resolver caches the result of resource resolution, but under crafted input it associates a resource with the wrong encoding in the cache. Both the servlet-based Spring MVC stack and the reactive Spring WebFlux stack share this resource handling path. The vulnerability is gated entirely behind non-default configuration: the resource chain must be explicitly enabled, caching must be turned on, and encoded resource support must be added - none of these are active out of the box. Affected CPE: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*, covering the VMware/Broadcom-maintained Spring project.

RemediationAI

Upgrade to a patched release as provided in the Spring security advisory at https://spring.io/security/cve-2026-22741: Spring Framework 5.3.48, 6.1.27, 6.2.18, or 7.0.7. These versions are vendor-confirmed fixes per the EUVD-2026-26206 entry. If an immediate upgrade is not possible, the two actionable mitigations are: (1) disable encoded resource resolution from the resource chain configuration - this eliminates the attack path entirely but means clients will no longer receive compressed (gzip/brotli) static assets, increasing bandwidth consumption; or (2) disable resource chain caching entirely, which also removes the poisoning target but introduces a performance regression under load as resources must be resolved on every request. The HeroDevs advisory at https://www.herodevs.com/vulnerability-directory/cve-2026-22741 may offer additional guidance for organizations running end-of-life Spring versions.