Executive brief
Spring Framework, a widely used tool for building Java-based web applications, is affected by a security flaw in how it handles static files like images and stylesheets. An attacker could potentially gain unauthorized access to sensitive information stored in the application's temporary memory (cache). This could lead to the exposure of data that was intended to be protected, though the attack is complex to execute.
Technical details
Spring Framework is vulnerable to an information disclosure flaw (CWE-524) within its Spring MVC and WebFlux components. The vulnerability occurs during the resolution of static resources when the application uses a cache that may contain sensitive information accessible to unauthorized actors. An unauthenticated remote attacker can exploit this to read sensitive data from the cache, although the attack complexity is rated as high. The issue affects multiple major versions of the framework, and users are advised to upgrade to patched versions such as 7.0.8 or 6.2.19 to mitigate the risk.
Affected products
- VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48
Timeline
- 2026-06-09: disclosed: Initial advisory publication
- 2026-06-09: advisory: GitHub Advisory GHSA-mq64-j8f9-9gcj published
- 2026-07-30: patched: Updated with patched version information