Vulnerability intelligence

CVE-2026-41842

Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CVSS Score

7.5

High

EPSS — Exploit Probability

0.0%

Riskier than 16% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Jun 9, 2026 · latest Jun 9, 2026

Coverage timeline

Spring Framework flaws allow LDAP bypass and DoS on Java clouds
securityonline.info · Jun 9, 2026