PT-2026-35909 · Vmware · Spring Mvc+1

Bocheng Xiang + 1 · Published 2026-04-29 · Updated 2026-05-15 · CVE-2026-22745

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Spring MVC (affected versions not specified) Spring WebFlux (affected versions not specified)

Description Applications using Spring MVC or Spring WebFlux are susceptible to Denial of Service attacks when serving static resources from the file system on Windows platforms. An attacker can send malicious requests that are slow to resolve, causing HTTP connections to remain occupied and leading to a service outage.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-22745

GHSA-6P4F-WCWH-5VVM

Affected Products

Spring Mvc

Spring Webflux

References · 7

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L&version=3.1 · Security Note
• https://spring.io/security/cve-2026-22745 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22745 · Security Note
• https://osv.dev/vulnerability/GHSA-6p4f-wcwh-5vvm · Vendor Advisory
• https://github.com/spring-projects/spring-framework · Note
• https://twitter.com/CVEnew/status/2049594365253743024 · Twitter Post
• https://twitter.com/f1tym1/status/2055314635016815034 · Twitter Post