Loading vulnerability…
Denial of Service in Spring MVC and WebFlux Versioned Static Resource Resolution
CVE-2026-41842 is an uncontrolled resource consumption vulnerability in Spring Framework's static resource resolution mechanism for Spring MVC and Spring WebFlux. Applications are vulnerable when they serve static resources from the filesystem with versioned resource support enabled through VersionResourceResolver. Crafted requests trigger pathologically slow resource resolution, keeping HTTP connections occupied; concurrent requests can exhaust available connections and deny service to legitimate clients. Affected versions include Spring Framework 7.0.0–7.0.7, 6.2.0–6.2.18, 6.1.0–6.1.27, and 5.3.0–5.3.48. Unsupported versions are also affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote, unauthenticated attackers can exhaust an application's available HTTP connections and prevent legitimate clients from establishing connections, potentially causing application-wide denial of service. The vulnerability has high availability impact, with no identified confidentiality or integrity impact. Its CVSS v3.1 base score is 7.5, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
If you can’t patch tonight, do this now.
No separate vendor-provided interim workaround is specified. Upgrading to a fixed release is the prescribed remediation, and no additional mitigation steps are required after upgrading.
Patch, then assume compromise.
Upgrade Spring Framework to the corresponding fixed release: 7.0.8 or later in the 7.0.x branch, 6.2.19 or later in the 6.2.x branch, 6.1.28 or later in the 6.1.x branch, or 5.3.49 or later in the 5.3.x branch. Commercial fixes are also available in 7.0.7.1 and 6.2.18.1; the 6.1.28 and 5.3.49 fixes require commercial access. Unsupported deployments should migrate to a supported, fixed release. For affected Atlassian Confluence installations, upgrade to the applicable fixed release: 9.2.26, 10.2.19, 11.0.0, or later. Affected Oracle Primavera Gateway deployments should apply the applicable October 2026 Critical Patch Update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.