Loading vulnerability…
Spring MVC and WebFlux Static Resource Cache Information Disclosure
CVE-2026-41841 is an information disclosure vulnerability in Spring Framework static resource resolution for Spring MVC and Spring WebFlux applications. Applications are vulnerable when multiple resource handlers use different resource locations, at least one handler requires authentication, and the handlers share a cache. If a publicly accessible resource is resolved and cached first, an attacker can subsequently access a protected resource with the same name. Affected versions are Spring Framework 7.0.0–7.0.7, 6.2.0–6.2.18, 6.1.0–6.1.27, and 5.3.0–5.3.48; unsupported versions are also affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can bypass the intended access restrictions on affected static resources and retrieve protected information. Confidentiality impact can be high, depending on the resources exposed. The vulnerability does not directly affect integrity or availability.
If you can’t patch tonight, do this now.
No additional mitigation steps are required after upgrading to a fixed release. No separate vendor-endorsed interim workaround is specified.
Patch, then assume compromise.
Upgrade Spring Framework to the fixed release for the applicable branch: 7.0.8 or 6.2.19 through OSS distribution channels; commercial fixes include 7.0.7.1, 6.2.18.1, 6.1.28, and 5.3.49. Unsupported deployments should migrate to a supported, fixed release. For vendor-packaged applications, apply the corresponding vendor security update containing the Spring Framework fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.