CVE-2026-41842: Spring Framework DoS Vulnerability in Static Resource Resolution

Technical summary

CVE-2026-41842 is a CWE-400 (Uncontrolled Resource Consumption) vulnerability in Spring Framework's static resource handling mechanism. When processing requests to resolve static resources, affected versions fail to properly limit resource consumption, allowing attackers to trigger uncontrolled CPU, memory, or connection usage. The vulnerability impacts both Spring MVC and the reactive WebFlux framework, affecting versions 5.3.0–5.3.48, 6.1.0–6.1.27, 6.2.0–6.2.18, and 7.0.0–7.0.7. Exploitation requires network access but no authentication or special privileges.

Business impact

Organizations running affected Spring applications face availability risk. A successful DoS attack could disrupt web services, APIs, and user-facing applications during critical business operations. The broad version range means legacy and recently patched systems alike may be vulnerable. Remediation requires coordinated patching across development and production environments, which may be resource-intensive for large deployments. The ease of exploitation (no authentication, low complexity) means this threat has high urgency relative to its technical severity score.

Affected systems

Any Spring Framework deployment running versions 5.3.0 through 7.0.7 is potentially affected. This includes applications built with Spring MVC (traditional servlet-based) and Spring WebFlux (reactive) frameworks. Version 5.3 reached mainstream support end-of-life in 2023 but may still run in production environments. Version 6.1 and 6.2 are actively maintained. Version 7.0 is the latest release line. Organizations should inventory Spring Framework versions in their application portfolio, including transitive dependencies brought in by other frameworks or libraries.

Exploitability

This vulnerability has a CVSS 3.1 score of 7.5 (HIGH), reflecting network accessibility, no authentication requirement, low attack complexity, and direct availability impact. The attack does not require user interaction. While not yet listed on CISA's Known Exploited Vulnerabilities catalog, the straightforward nature of triggering resource exhaustion via HTTP requests means exploitability is likely immediate once public details emerge. Attackers can identify vulnerable versions through application fingerprinting. No special tools or insider knowledge are needed.

Remediation

Upgrade Spring Framework to patched versions beyond those listed as vulnerable. Consult the VMware Spring Security Advisory for specific patch versions for each minor release line. Organizations should prioritize patching based on criticality of the affected application and whether it is internet-facing. Additionally, implement network-level rate limiting or Web Application Firewall (WAF) rules to restrict the rate of requests to static resource endpoints, which may provide temporary mitigation while patching is underway. Monitor application resource usage for signs of active exploitation.

Patch guidance

Verify the latest patched Spring Framework versions through the official VMware Spring Framework advisory page. Update your dependency management (Maven pom.xml, Gradle build.gradle, or equivalent) to reference the first patched version for your current minor release. Test patches thoroughly in a staging environment to ensure compatibility with application-specific extensions or customizations. For applications using Spring Boot, update the spring-boot-starter-parent or individual spring-framework dependencies and rebuild. Consider using automated dependency scanning tools to identify and flag vulnerable versions in your codebase.

Detection guidance

Monitor application logs for repeated requests to static resource endpoints, especially those with unusual or malformed path parameters. Look for sudden spikes in CPU, memory, or connection pool exhaustion correlating with HTTP traffic patterns. Network intrusion detection systems (IDS) may flag high-frequency requests to the same resource path. Spring Framework debug logs can reveal resource resolution attempts. Proactive scanning using software composition analysis (SCA) tools will identify vulnerable Spring Framework versions in your codebase and supply chain. Implement application performance monitoring (APM) to establish baselines and alert on anomalous resource consumption.

Why prioritize this

Although the CVSS score is HIGH (7.5), the practical risk is elevated by the large installed base across multiple version lines, the trivial nature of exploitation (unauthenticated network attack), and the direct business impact (availability). The absence from KEV at the time of writing does not reflect low exploit likelihood; it reflects the recency of the disclosure. Internet-facing applications should be patched urgently. Internal-only systems may be deprioritized relative to external-facing services, but should not be neglected.

Risk score, explained

The CVSS 3.1 score of 7.5 is driven by: (1) Network accessibility (AV:N) – the attack is remotely exploitable; (2) Low attack complexity (AC:L) – no special preconditions or tools required; (3) No privileges required (PR:N) – unauthenticated attackers can exploit; (4) No user interaction (UI:N) – the attack succeeds without social engineering; (5) High availability impact (A:H) – successful exploitation degrades or disables the service. The absence of confidentiality or integrity impact reflects that this is purely a DoS vulnerability. The score appropriately reflects a critical business risk even if data confidentiality is not compromised.

Frequently asked questions