CVE-2026-22741: Spring Framework cache poisoning in static resource resolution

CVE-2026-22741 · Severity: low · CVSS 3.1 · Published 2026-04-29

Spring MVC and WebFlux, frameworks used to build Java web applications, are vulnerable to a cache poisoning issue when serving static files like images or scripts. An attacker can send specially crafted requests that cause the system to store and serve files with incorrect encoding. This can break the website's user interface for other visitors, effectively causing a partial service outage.

Technologies: org.springframework:spring-webflux (Maven), org.springframework:spring-webmvc (Maven), VMware Spring Framework. Vendors: Broadcom, Maven, VMware.

Quick answers

Is CVE-2026-22741 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22741 being exploited in the wild.
How severe is CVE-2026-22741?
Low severity, with a CVSS score of 3.1, published 29 April 2026.
Which products and versions are affected?
Broadcom Web MVC >= 7.0.0, <= 7.0.6; >= 6.2.0, <= 6.2.17; >= 6.1.0, <= 6.1.26; <= 5.3.47; Broadcom WebFlux >= 7.0.0, <= 7.0.6; >= 6.2.0, <= 6.2.17; >= 6.1.0, <= 6.1.26; <= 5.3.47; org.springframework:spring-webflux (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.7; org.springframework:spring-webmvc (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.7.
Is there a fix for CVE-2026-22741?
Yes. org.springframework:spring-webflux (Maven): upgrade to 7.0.7 or later; org.springframework:spring-webmvc (Maven): upgrade to 7.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22741 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-22741?
Check whether you run Broadcom Web MVC, Broadcom WebFlux, org.springframework:spring-webflux (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework:spring-webflux (Maven): upgrade to 7.0.7 or later
    # set org.springframework:spring-webflux to 7.0.7 in your pom.xml or build.gradle
  • org.springframework:spring-webmvc (Maven): upgrade to 7.0.7 or later
    # set org.springframework:spring-webmvc to 7.0.7 in your pom.xml or build.gradle

Technical details

Spring MVC and WebFlux are vulnerable to cache poisoning (CWE-524) within the static resource resolution mechanism. The vulnerability occurs when the resource chain is configured with caching enabled and support for encoded resource resolution is active. An attacker can exploit this by sending malicious requests when the resource cache is empty, forcing the application to cache resources with incorrect encoding. This results in a denial of service for the front-end application as clients receive corrupted or improperly encoded static assets. Patches are available in versions 7.0.7 and 6.2.18.

Affected products

  • Spring spring-webflux >= 7.0.0, <= 7.0.6; >= 6.2.0, <= 6.2.17; >= 6.1.0, <= 6.1.26; <= 5.3.47
  • Spring spring-webmvc >= 7.0.0, <= 7.0.6; >= 6.2.0, <= 6.2.17; >= 6.1.0, <= 6.1.26; <= 5.3.47

Identifiers

  • CVE-2026-22741
  • GHSA-wg35-8jpf-2xv3

Timeline

  • 2026-04-29: disclosed
  • 2026-04-29: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.