What is the CVSS score of CVE-2026-41842?

CVE-2026-41842 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring Framework are affected by CVE-2026-41842?

Spring Framework versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7 contain a denial-of-service vulnerability in static resource resolution that allows unauthenticated remote…. A patch is available.

How to fix or mitigate CVE-2026-41842?

Within 24 hours: Conduct complete inventory of Spring Framework usage across all applications; identify systems running versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, or 7.0.0-7.0.7; begin deploying WAF rules to rate-limit requests to static resource paths. Within 7 days: Implement connection and request timeouts (30-60 seconds) at load balancer and application levels; enable rate limiting (e.g., 100 requests/minute per source IP) on static content endpoints; enable DDoS protection on internet-facing applications. Within 30 days: Subscribe to VMware/Spring Security advisories; prepare upgrade plans for patched versions when released (monitor for 5.3.49+, 6.1.28+, 6.2.19+, 7.0.8+); schedule patching for affected production environments.

Spring Framework CVE-2026-41842

EUVD-2026-35330 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-09 vmware

GHSA-x23c-287f-qqv5

Denial Of Service Java Spring Framework Red Hat

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:08 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.springframework:spring-webflux (5 direct, 1 indirect)
21 maven packages depend on org.springframework:spring-webmvc (13 direct, 8 indirect)

Ecosystem-wide dependent count for version 7.0.0 and other introduced versions.

DescriptionCVE.org

Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Articles & Coverage 1

News 9 New Java Vulnerabilities - 1 Critical, 8 High Severity Jun 10, 2026

AnalysisAI

Denial of service in Spring Framework's Spring MVC and WebFlux static resource resolution allows remote unauthenticated attackers to exhaust application resources, affecting versions 5.3.0-5.3.48, 6.1.0-6.1.27, 6.2.0-6.2.18, and 7.0.0-7.0.7. The CVSS 7.5 score reflects high-impact availability damage over the network with no privileges or user interaction, and at time of analysis no public exploit identified at time of analysis. The flaw was reported by VMware (Spring's maintainer) and is tracked under the official Spring Security advisory.

Technical ContextAI

Spring Framework is the foundational Java application framework underpinning both Spring MVC (Servlet stack) and Spring WebFlux (reactive stack) used to build a large share of enterprise Java web applications. Both stacks include a static resource handling subsystem (e.g., ResourceHttpRequestHandler / ResourceWebHandler) that maps incoming HTTP request paths to files on the classpath or filesystem, performing path resolution, encoding handling, and caching. The CWE-400 (Uncontrolled Resource Consumption) classification indicates the resolver performs work whose cost is not properly bounded relative to attacker-controlled input, allowing a malicious request to consume disproportionate CPU, memory, threads, or I/O. Because the CPE covers spring:spring_framework across multiple major branches simultaneously (5.3, 6.1, 6.2, 7.0), the underlying defect is in shared resource-resolution logic carried across releases rather than a regression in a single line.

RemediationAI

Patch available per vendor advisory at https://spring.io/security/cve-2026-41842 - upgrade Spring Framework to the first fixed release on your supported branch (the advisory lists fixed versions above 7.0.7, 6.2.18, 6.1.27, and 5.3.48; consult the advisory for the exact build number for your branch as the input does not provide a single canonical fix version). For Spring Boot users, bump spring-boot-dependencies / spring-framework.version to pull in the patched framework rather than overriding individual modules. If patching cannot be completed immediately, compensating controls include placing a reverse proxy or WAF in front of the application to rate-limit and bound request sizes on the static resource paths (typically /resources/, /static/, /webjars/**, or any handler registered via addResourceHandlers), restricting which paths are exposed by ResourceHandlerRegistry to only the minimum needed (with the trade-off that legitimately served assets must be relocated), and disabling or fronting static resource serving with a CDN/static web server such as nginx so the Spring application no longer resolves these requests (trade-off: deployment topology change). Monitor for spikes in handler thread occupancy and request latency on static paths until patched.