# CVE-2026-41841: VMware Spring Framework information disclosure in static resource resolution

Source: https://junglewise.ai/threats/cve-2026-41841-vmware-spring-framework-information-disclosure-in-static-resource  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-41841 · Severity: medium · CVSS 5.9 · Published 2026-06-09

Spring Framework, a widely used tool for building Java-based web applications, is affected by a security flaw in how it handles static files like images and stylesheets. An attacker could potentially gain unauthorized access to sensitive information stored in the application's temporary memory (cache). This could lead to the exposure of data that was intended to be protected, though the attack is complex to execute.

Technologies: [org.springframework:spring-webflux (Maven)](https://junglewise.ai/threats/technologies/org-springframework-spring-webflux), [org.springframework:spring-webmvc (Maven)](https://junglewise.ai/threats/technologies/org-springframework-spring-webmvc), [VMware Spring Framework](https://junglewise.ai/threats/technologies/spring-framework). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41841 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41841 being exploited in the wild.

**How severe is CVE-2026-41841?** Medium severity, with a CVSS score of 5.9, published 9 June 2026.

**Which products and versions are affected?** org.springframework:spring-webflux (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; org.springframework:spring-webmvc (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48.

**Is there a fix for CVE-2026-41841?** Yes. org.springframework:spring-webflux (Maven): upgrade to 7.0.8 or later; org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41841 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41841?** Check whether you run org.springframework:spring-webflux (Maven), org.springframework:spring-webmvc (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework:spring-webflux (Maven): upgrade to 7.0.8 or later

  ```sh
  # set org.springframework:spring-webflux to 7.0.8 in your pom.xml or build.gradle
  ```

- org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later

  ```sh
  # set org.springframework:spring-webmvc to 7.0.8 in your pom.xml or build.gradle
  ```


## Technical details

Spring Framework is vulnerable to an information disclosure flaw (CWE-524) within its Spring MVC and WebFlux components. The vulnerability occurs during the resolution of static resources when the application uses a cache that may contain sensitive information accessible to unauthorized actors. An unauthenticated remote attacker can exploit this to read sensitive data from the cache, although the attack complexity is rated as high. The issue affects multiple major versions of the framework, and users are advised to upgrade to patched versions such as 7.0.8 or 6.2.19 to mitigate the risk.

## Affected products

- VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48

## Identifiers

- CVE-2026-41841
- GHSA-mq64-j8f9-9gcj

## Timeline

- 2026-06-09: disclosed: Initial advisory publication
- 2026-06-09: advisory: GitHub Advisory GHSA-mq64-j8f9-9gcj published
- 2026-07-30: patched: Updated with patched version information

## References

- [https://spring.io/security/cve-2026-41841](https://spring.io/security/cve-2026-41841)
- [https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19](https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19)
- [https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8](https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8)

## Related threats

- [Spring Framework stream corruption in Server-Sent Events](https://junglewise.ai/threats/cve-2026-59313-spring-framework-stream-corruption-in-server-sent-events)
- [Spring Framework Server Sent Event stream corruption while rendering fragments](https://junglewise.ai/threats/cve-2026-47890-spring-framework-server-sent-event-stream-corruption-while)
- [Spring Framework information disclosure in WebSocket exception handling](https://junglewise.ai/threats/cve-2026-47893-spring-framework-information-disclosure-in-websocket-exception)
- [Spring Framework header predicate bypass in WebFlux functional endpoints](https://junglewise.ai/threats/cve-2026-47892-spring-framework-header-predicate-bypass-in-webflux-functional)
- [Spring Framework XML maxInMemorySize enforcement bypass](https://junglewise.ai/threats/cve-2026-47891-spring-framework-xml-maxinmemorysize-enforcement-bypass)