7.5 HighCWE-400
CVE-2026-41842
Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux
SpringSpring Framework
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 24 Oct
0.4%probability of exploitation in the next 30 days
Higher than 33% of scored CVEs
SeverityCVSS
7.5High
Description NVD
Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Coverage 1 article · 1 outlet
- Spring Framework flaws allow LDAP bypass and DoS on Java cloudsSecurityOnline · first in our coverage · mentions it in passing