CVE-2026-22741

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22741", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-01-09T06:54:49.675Z", "datePublished": "2026-04-29T11:32:12.548Z", "dateUpdated": "2026-04-29T14:01:42.273Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-04-29T14:01:42.273Z"}, "title": "Static resource cache poisoning in Spring MVC and WebFlux", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-524", "description": "CWE-524 Information Exposure Through Caching", "type": "CWE"}]}], "affected": [{"vendor": "VMware", "product": "Spring Framework", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.0.7", "versionType": "oss"}, {"status": "affected", "version": "6.2.0", "lessThan": "6.2.18", "versionType": "oss"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.27", "versionType": "commercial"}, {"status": "affected", "version": "5.3.0", "lessThan": "5.3.48", "versionType": "commercial"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.\n\n\nMore precisely, an application can be vulnerable when all the following are true:\n\n * the application is using Spring MVC or Spring WebFlux\n * the application is configuring the\u00a0 resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title \u00a0with caching enabled\n * the application adds support for encoded resources resolution\n * the resource cache must be empty when the attacker has access to the application\n\n\nWhen all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.<br></p><p>More precisely, an application can be vulnerable when all the following are true:</p><ul><li>the application is using Spring MVC or Spring WebFlux</li><li>the application is configuring the&nbsp;<a href=\"https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title\">resource chain support</a>&nbsp;with caching enabled</li><li>the application adds support for encoded resources resolution</li><li>the resource cache must be empty when the attacker has access to the application</li></ul><p>When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.</p>"}]}], "references": [{"url": "https://spring.io/security/cve-2026-22741"}, {"url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L&version=3.1"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "LOW", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"}}], "credits": [{"lang": "en", "value": "Yuki Matsuhashi .", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-29T13:19:19.166572Z", "id": "CVE-2026-22741", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-29T13:19:38.299Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22741", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-29T13:19:19.166572Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-29T13:19:34.363Z"}}], "cna": {"title": "Static resource cache poisoning in Spring MVC and WebFlux", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Yuki Matsuhashi ."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VMware", "product": "Spring Framework", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.0.7", "versionType": "oss"}, {"status": "affected", "version": "6.2.0", "lessThan": "6.2.18", "versionType": "oss"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.27", "versionType": "commercial"}, {"status": "affected", "version": "5.3.0", "lessThan": "5.3.48", "versionType": "commercial"}], "defaultStatus": "affected"}], "references": [{"url": "https://spring.io/security/cve-2026-22741"}, {"url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L&version=3.1"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.\n\n\nMore precisely, an application can be vulnerable when all the following are true:\n\n * the application is using Spring MVC or Spring WebFlux\n * the application is configuring the\u00a0 resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title \u00a0with caching enabled\n * the application adds support for encoded resources resolution\n * the resource cache must be empty when the attacker has access to the application\n\n\nWhen all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.", "supportingMedia": [{"type": "text/html", "value": "<p>Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.<br></p><p>More precisely, an application can be vulnerable when all the following are true:</p><ul><li>the application is using Spring MVC or Spring WebFlux</li><li>the application is configuring the&nbsp;<a href=\"https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title\">resource chain support</a>&nbsp;with caching enabled</li><li>the application adds support for encoded resources resolution</li><li>the resource cache must be empty when the attacker has access to the application</li></ul><p>When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-524", "description": "CWE-524 Information Exposure Through Caching"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-04-29T14:01:42.273Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22741", "state": "PUBLISHED", "dateUpdated": "2026-04-29T14:01:42.273Z", "dateReserved": "2026-01-09T06:54:49.675Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-04-29T11:32:12.548Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Spring Framework", "vendor": "VMware", "versions": [{"lessThan": "7.0.7", "status": "affected", "version": "7.0.0", "versionType": "oss"}, {"lessThan": "6.2.18", "status": "affected", "version": "6.2.0", "versionType": "oss"}, {"lessThan": "6.1.27", "status": "affected", "version": "6.1.0", "versionType": "commercial"}, {"lessThan": "5.3.48", "status": "affected", "version": "5.3.0", "versionType": "commercial"}]}], "source": "security@vmware.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "matchCriteriaId": "23C9BFA0-DDE5-4E6D-A9E0-ECC236913DF3", "versionEndExcluding": "5.3.48", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC58C148-219F-4868-B9F0-E0AF4435EF79", "versionEndExcluding": "6.1.27", "versionStartIncluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "matchCriteriaId": "F317C66F-752D-40A9-AECF-5D1E51368AFE", "versionEndExcluding": "6.2.18", "versionStartIncluding": "6.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "matchCriteriaId": "78C5C95C-1A83-40E7-8C73-D5965E20BD06", "versionEndExcluding": "7.0.7", "versionStartIncluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.\n\n\nMore precisely, an application can be vulnerable when all the following are true:\n\n * the application is using Spring MVC or Spring WebFlux\n * the application is configuring the\u00a0 resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title \u00a0with caching enabled\n * the application adds support for encoded resources resolution\n * the resource cache must be empty when the attacker has access to the application\n\n\nWhen all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients."}, {"lang": "es", "value": "Las aplicaciones Spring MVC y WebFlux son vulnerables al envenenamiento de cach\u00e9 al resolver recursos est\u00e1ticos.\n\nM\u00e1s precisamente, una aplicaci\u00f3n puede ser vulnerable cuando se cumplen todas las condiciones siguientes:\n\n * la aplicaci\u00f3n est\u00e1 utilizando Spring MVC o Spring WebFlux\n * la aplicaci\u00f3n est\u00e1 configurando el soporte de cadena de recursos https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title con el almacenamiento en cach\u00e9 habilitado\n * la aplicaci\u00f3n a\u00f1ade soporte para la resoluci\u00f3n de recursos codificados\n * la cach\u00e9 de recursos debe estar vac\u00eda cuando el atacante tiene acceso a la aplicaci\u00f3n\n\nCuando se cumplen todas las condiciones anteriores, el atacante puede enviar solicitudes maliciosas y envenenar la cach\u00e9 de recursos con recursos que utilizan la codificaci\u00f3n incorrecta. Esto puede causar una denegaci\u00f3n de servicio al romper la aplicaci\u00f3n de front-end para los clientes."}], "id": "CVE-2026-22741", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22741", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-29T13:19:19.166572Z", "version": "2.0.3"}}]}, "published": "2026-04-29T12:16:18.487", "references": [{"source": "security@vmware.com", "tags": ["US Government Resource"], "url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L&version=3.1"}, {"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2026-22741"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-524"}], "source": "security@vmware.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning", "id": "2463788", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463788"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-838", "details": ["A flaw was found in Spring MVC and Spring WebFlux applications. A remote attacker can exploit this vulnerability by sending malicious requests to poison the resource cache with incorrectly encoded resources. This can lead to a denial of service (DoS) by disrupting the front-end application for clients. This vulnerability occurs when the application uses resource chain support with caching enabled, supports encoded resource resolution, and the resource cache is empty."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, applications utilizing Spring MVC or Spring WebFlux should disable resource chain support caching or encoded resource resolution if these features are not essential for their operation. Consult Spring Framework documentation for specific configuration details. A restart of the affected application will be required for changes to take effect."}, "name": "CVE-2026-22741", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "spring-webmvc", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "spring-webmvc", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Fix deferred", "package_name": "spring-webflux", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Fix deferred", "package_name": "spring-webmvc", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:optaplanner:::el6", "fix_state": "Fix deferred", "package_name": "spring-webmvc", "product_name": "Red Hat build of OptaPlanner 8"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Fix deferred", "package_name": "spring-webmvc", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "log4j:2/log4j", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "pki-core:10.6/resteasy", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "pki-deps:10.6/resteasy", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "log4j", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "resteasy", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Fix deferred", "package_name": "spring-webflux", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Fix deferred", "package_name": "spring-webmvc", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Fix deferred", "package_name": "spring-webflux", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Fix deferred", "package_name": "spring-webmvc", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "spring-webflux", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "spring-webmvc", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "spring-webflux", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "spring-webmvc", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Fix deferred", "package_name": "spring-webmvc", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Fix deferred", "package_name": "spring-webmvc", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-04-29T11:32:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-22741\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22741\nhttps://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L&version=3.1\nhttps://spring.io/security/cve-2026-22741"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.0.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.2.0,6.2.18)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.0,6.1.27)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.3.0,5.3.48)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Spring Framework", "source": "cna", "vendor": "VMware"}, "product": "spring_framework", "vendor": "vmware"}], "created": "2026-04-29T14:30:13.079039+00:00", "updated": "2026-05-04T14:00:20.299101+00:00", "vendors": ["vmware", "vmware$PRODUCT$spring_framework"]}