CVE-2026-41841: Spring Framework Static Resource Information Disclosure

Technical summary

This vulnerability stems from inadequate validation when Spring MVC and WebFlux resolve static resources. The flaw allows information disclosure through CWE-524 (Exposure of Sensitive Information Through Cached Data or Logs). An attacker without authentication can potentially access restricted files by manipulating resource resolution logic. The CVSS 3.1 score of 5.9 reflects high confidentiality impact but limited attack surface—exploitation requires relatively specific conditions (AC:H) and cannot be executed remotely without user interaction boundaries, though no user interaction is strictly required.

Business impact

Confidentiality breaches could expose application secrets, configuration data, or customer information embedded in or accessible through static resources. For organizations running Spring-based applications, the risk depends on what sensitive data might be accessible through resource endpoints. This is particularly concerning for multi-tenant or compliance-heavy environments where unauthorized information access triggers breach notification obligations and regulatory scrutiny.

Affected systems

Spring Framework versions 7.0.0–7.0.7, 6.2.0–6.2.18, 6.1.0–6.1.27, and 5.3.0–5.3.48 are vulnerable. Any application using Spring MVC or Spring WebFlux for static resource serving is in scope. Organizations should audit their Spring versions immediately, as both current (7.x, 6.2.x) and legacy (6.1.x, 5.3.x) lines are affected.

Exploitability

This is not a publicly known exploit (KEV status: not added). Exploitation requires network access and specific knowledge of the target application's resource structure, reflected in the AC:H (Attack Complexity: High) rating. While no authentication is needed, the attacker must understand how the application resolves and caches resources to successfully bypass controls. This limits exploitation to targeted attacks rather than opportunistic scanning.

Remediation

Upgrade Spring Framework to patched versions: verify against the vendor advisory for exact patch version numbers across all four affected release lines. Organizations unable to patch immediately should restrict access to static resource endpoints via WAF rules or reverse proxy configurations, and audit logs for suspicious resource access patterns.

Patch guidance

Contact VMware or consult the official Spring Framework security advisory for specific patched versions corresponding to each release line (5.3.x, 6.1.x, 6.2.x, 7.0.x). Apply patches in a staged manner, testing thoroughly in non-production environments first given the breadth of affected versions. Prioritize applications exposing sensitive static resources or serving multi-tenant workloads.

Detection guidance

Monitor application logs and WAF logs for anomalous requests to static resource endpoints, particularly those containing path traversal sequences or encoded characters that might indicate resource path manipulation. Look for successful responses returning unexpected file types or sizes. Network-level detection should flag requests to static endpoints from IPs not in expected client ranges if your environment permits such segmentation.

Why prioritize this

Although rated MEDIUM severity and not yet weaponized, this vulnerability affects four major Spring Framework version lines and impacts a core feature (static resource resolution). Organizations running Spring applications should treat this with high priority for inventory and patching given the widespread deployment of Spring MVC/WebFlux, the simplicity of the attack vector, and the potential for high-value data exposure in production environments.

Risk score, explained

CVSS 5.9 (MEDIUM) reflects high confidentiality impact (C:H) but limited exploitability: attack complexity is high (AC:H), no user interaction is required, and attack is network-based. The score appropriately captures that while the vulnerability is serious, real-world exploitation demands reconnaissance and specific conditions rather than blind exploitation. Context—your application's sensitivity and exposure—should inform internal risk prioritization above the base CVSS.

Frequently asked questions