What is the CVSS score of CVE-2026-41841?

CVE-2026-41841 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41841?

Yes, a patch is available for CVE-2026-41841. Update the affected software to the latest version immediately.

Spring Framework CVE-2026-41841

EUVD-2026-35328 MEDIUM

Use of Cache Containing Sensitive Information (CWE-524)

2026-06-09 vmware

GHSA-mq64-j8f9-9gcj

Information Disclosure Java Spring Framework

5.9

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:25 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.springframework:spring-webflux (5 direct, 1 indirect)
21 maven packages depend on org.springframework:spring-webmvc (13 direct, 8 indirect)

Ecosystem-wide dependent count for version 7.0.0 and other introduced versions.

DescriptionCVE.org

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

AnalysisAI

Information disclosure in Spring Framework's static resource resolution affects Spring MVC and WebFlux applications across four active release lines (5.3.x, 6.1.x, 6.2.x, and 7.0.x). Unauthenticated remote attackers exploiting this flaw can access sensitive cached content served through the static resource handling pipeline, achieving high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H vector indicates exploitation requires specific conditions beyond default network access.

Technical ContextAI

Spring Framework (cpe:2.3:a:spring:spring_framework) provides centralized static resource serving via ResourceHttpRequestHandler in Spring MVC and its reactive equivalent in WebFlux. CWE-524 (Use of Cache-Containing Sensitive Information) is the root cause class, indicating the framework's internal resource resolution cache may retain sensitive content or metadata that becomes accessible to unauthorized parties under exploitable conditions. The Java-based runtime stores resolved resource handles in application-level caches to optimize repeated requests; a flaw in the cache key derivation or access-control check during resolution could permit a crafted request to retrieve cache entries pointing to sensitive resources. Both the synchronous servlet stack (Spring MVC) and the reactive non-blocking stack (Spring WebFlux) are affected, indicating the vulnerability resides in shared resource resolution infrastructure rather than a stack-specific component.

RemediationAI

The primary remediation is to upgrade to a patched Spring Framework release. Based on the upper bounds of the affected version ranges, fix versions are implied to be 5.3.49+, 6.1.28+, 6.2.19+, and 7.0.8+ for their respective branches, but these exact release versions are not independently confirmed from the available input data - consult the vendor advisory at https://spring.io/security/cve-2026-41841 for the authoritative fix version and release notes before upgrading. For applications where an immediate upgrade is not feasible, a targeted workaround is to restrict static resource serving to only non-sensitive, explicitly whitelisted directories, ensuring no confidential content (configuration fragments, credential files, internal templates) is co-located under paths served by ResourceHttpRequestHandler. Disabling or tightly scoping the resource cache via ResourceHandlerRegistry configuration (e.g., setCacheControl, setting cache period to zero) may reduce the exploitable cache attack surface but carries a performance trade-off by increasing file I/O on every request. Applications using Spring Boot's auto-configured static resource handling should verify that spring.web.resources.add-mappings=true is necessary for their deployment; disabling it entirely eliminates the attack vector if static resource serving is not required.