PT-2026-35908 · Vmware · Spring Webflux+1

Yuki Matsuhashi · Published 2026-04-29 · Updated 2026-05-15 · CVE-2026-22741

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Spring MVC (affected versions not specified) Spring WebFlux (affected versions not specified)

Description Applications using Spring MVC or Spring WebFlux are susceptible to cache poisoning during the resolution of static resources. This occurs when resource chain support is configured with caching enabled and support for encoded resources resolution is added, provided the resource cache is empty. An attacker can send malicious requests to poison the resource cache with resources using incorrect encoding, potentially leading to a denial of service by breaking the front-end application for clients.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-524

Related Identifiers

CVE-2026-22741

GHSA-WG35-8JPF-2XV3

Affected Products

Spring Mvc

Spring Webflux

References · 13

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L&version=3.1 · Security Note
• https://spring.io/security/cve-2026-22741 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22741 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22741 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-22741 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22741 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wg35-8jpf-2xv3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22741 · Security Note
• https://ubuntu.com/security/CVE-2026-22741 · Vendor Advisory
• https://github.com/spring-projects/spring-framework · Note
• https://twitter.com/f1tym1/status/2055314633263640932 · Twitter Post
• https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title · Note
• https://twitter.com/CVEnew/status/2049594366893650389 · Twitter Post