# CVE-2026-41842: VMware Spring Framework denial of service in static resource resolution

Source: https://junglewise.ai/threats/cve-2026-41842-vmware-spring-framework-dos-in-static-resource-resolution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-41842 · Severity: high · CVSS 7.5 · Published 2026-06-09

Spring Framework, a widely used foundation for building Java-based web applications, is vulnerable to a flaw that could allow an attacker to crash or slow down a website. By sending specifically crafted requests for static files (like images or stylesheets), an attacker can exhaust server resources, making the application unavailable to legitimate users. This affects applications using the Spring MVC or WebFlux modules to serve versioned resources.

Technologies: [org.springframework:spring-webflux (Maven)](https://junglewise.ai/threats/technologies/org-springframework-spring-webflux), [org.springframework:spring-webmvc (Maven)](https://junglewise.ai/threats/technologies/org-springframework-spring-webmvc), [VMware Spring Framework](https://junglewise.ai/threats/technologies/spring-framework). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41842 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41842 being exploited in the wild.

**How severe is CVE-2026-41842?** High severity, with a CVSS score of 7.5, published 9 June 2026.

**Which products and versions are affected?** org.springframework:spring-webflux (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; org.springframework:spring-webmvc (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48, 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

**Is there a fix for CVE-2026-41842?** Yes. org.springframework:spring-webflux (Maven): upgrade to 7.0.8 or later; org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41842 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41842?** Check whether you run org.springframework:spring-webflux (Maven), org.springframework:spring-webmvc (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework:spring-webflux (Maven): upgrade to 7.0.8 or later

  ```sh
  # set org.springframework:spring-webflux to 7.0.8 in your pom.xml or build.gradle
  ```

- org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later

  ```sh
  # set org.springframework:spring-webmvc to 7.0.8 in your pom.xml or build.gradle
  ```


## Technical details

A Denial of Service (DoS) vulnerability exists in Spring Framework's MVC and WebFlux modules due to uncontrolled resource consumption (CWE-400) during the resolution of versioned static resources. An unauthenticated remote attacker can exploit this by sending specially crafted requests that trigger excessive resource allocation or processing time. The vulnerability affects multiple major release branches including 5.3.x, 6.1.x, 6.2.x, and 7.0.x. Patches have been released in versions 6.2.19 and 7.0.8, with other branches requiring updates to their respective latest maintenance releases.

## Affected products

- VMware Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48

## Identifiers

- CVE-2026-41842
- GHSA-x23c-287f-qqv5

## Timeline

- 2026-06-09: disclosed: Initial disclosure and NVD publication
- 2026-06-09: advisory: GitHub Advisory published
- 2026-07-30: patched: Advisory updated with reviewed patch information

## References

- [https://spring.io/security/cve-2026-41842](https://spring.io/security/cve-2026-41842)
- [https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19](https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19)
- [https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8](https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8)

## Related threats

- [Spring Framework stream corruption in Server-Sent Events](https://junglewise.ai/threats/cve-2026-59313-spring-framework-stream-corruption-in-server-sent-events)
- [Spring Framework Server Sent Event stream corruption while rendering fragments](https://junglewise.ai/threats/cve-2026-47890-spring-framework-server-sent-event-stream-corruption-while)
- [Spring Framework information disclosure in WebSocket exception handling](https://junglewise.ai/threats/cve-2026-47893-spring-framework-information-disclosure-in-websocket-exception)
- [Spring Framework header predicate bypass in WebFlux functional endpoints](https://junglewise.ai/threats/cve-2026-47892-spring-framework-header-predicate-bypass-in-webflux-functional)
- [Spring Framework XML maxInMemorySize enforcement bypass](https://junglewise.ai/threats/cve-2026-47891-spring-framework-xml-maxinmemorysize-enforcement-bypass)