What is the CVSS score of CVE-2026-22745?

CVE-2026-22745 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-22745?

Yes, a patch is available for CVE-2026-22745. Update the affected software to the latest version immediately.

Spring Framework CVE-2026-22745

EUVD-2026-26207 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-29 vmware

Denial Of Service Java Microsoft VMware Spring Framework

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated attack with no complexity; impact is availability-only and limited, with no confidentiality or integrity consequences.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:58 vuln.today

Patch released

May 04, 2026 - 14:50 nvd

Patch available

Apr 29, 2026 - 13:01 EUVD

EUVD ID Assigned

Apr 29, 2026 - 12:00 euvd

EUVD-2026-26207

CVE Published

Apr 29, 2026 - 11:35 nvd

MEDIUM 5.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.springframework:spring-webflux (5 direct, 1 indirect)
23 maven packages depend on org.springframework:spring-webmvc (14 direct, 9 indirect)

Ecosystem-wide dependent count for version 7.0.0 and other introduced versions.

DescriptionCVE.org

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.

More precisely, an application can be vulnerable when all the following are true:

the application is using Spring MVC or Spring WebFlux
the application is serving static resources from the file system
the application is running on a Windows platform

When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.

AnalysisAI

Denial of Service in Spring Framework's static resource serving affects Spring MVC and Spring WebFlux applications running on Windows, where crafted HTTP requests trigger abnormally slow Windows file system resolution, exhausting HTTP connection pools. Affected branches span 5.3.x through 7.0.x; fixed versions are available from VMware/Spring. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.05% at the 16th percentile, and SSVC rates exploitation as 'none' - but the attack is automatable and unauthenticated, making it meaningful for any qualifying Windows Spring deployment.

Technical ContextAI

Spring Framework (CPE: cpe:2.3:a:vmware:spring_framework) is VMware's flagship Java application framework underpinning both the traditional Spring MVC servlet model and the reactive Spring WebFlux model. The root cause maps to CWE-400 (Uncontrolled Resource Consumption): the static resource resolution path does not bound the time or resources spent processing requests against the Windows file system, allowing slow path lookups to hold HTTP worker threads or reactive event-loop connections open indefinitely. This is a Windows-specific behavior because the Windows NTFS/path resolution layer exhibits latency characteristics under certain malformed or crafted path inputs that Linux ext4/VFS does not replicate, making the vulnerability platform-conditional. Affected versions cover four actively maintained branches: 5.3.x, 6.1.x, 6.2.x, and 7.0.x.

RemediationAI

Upgrade Spring Framework to the appropriate fixed release for your branch: 5.3.48, 6.1.27, 6.2.18, or 7.0.7, as documented in the vendor advisory at https://spring.io/security/cve-2026-22745. If an immediate upgrade is not feasible, the most effective workaround is to offload static resource serving to a reverse proxy (such as nginx or IIS) placed in front of the Spring application, which eliminates the vulnerable code path entirely with no Spring-side trade-offs. Alternatively, rate-limiting or connection-count capping at the load balancer or WAF layer can reduce the blast radius of connection-exhaustion attacks, though this does not fix the underlying slow-resolution behavior. Migrating the application to a Linux host removes the platform condition and fully mitigates the vulnerability without a code change, though this may introduce operational overhead. Note that none of the compensating controls address the root CWE-400 flaw - patching remains the definitive fix.