Executive brief
Spring Framework, a widely used foundation for building Java-based web applications, is vulnerable to a flaw that could allow an attacker to crash or slow down a website. By sending specifically crafted requests for static files (like images or stylesheets), an attacker can exhaust server resources, making the application unavailable to legitimate users. This affects applications using the Spring MVC or WebFlux modules to serve versioned resources.
Technical details
A Denial of Service (DoS) vulnerability exists in Spring Framework's MVC and WebFlux modules due to uncontrolled resource consumption (CWE-400) during the resolution of versioned static resources. An unauthenticated remote attacker can exploit this by sending specially crafted requests that trigger excessive resource allocation or processing time. The vulnerability affects multiple major release branches including 5.3.x, 6.1.x, 6.2.x, and 7.0.x. Patches have been released in versions 6.2.19 and 7.0.8, with other branches requiring updates to their respective latest maintenance releases.
Affected products
- VMware Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48
Timeline
- 2026-06-09: disclosed: Initial disclosure and NVD publication
- 2026-06-09: advisory: GitHub Advisory published
- 2026-07-30: patched: Advisory updated with reviewed patch information