medium5.9
CVE-2026-41841
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.
Impact
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework:spring-webmvc | >= 7.0.0, <= 7.0.7 | 7.0.8 |
| maven | org.springframework:spring-webflux | >= 7.0.0, <= 7.0.7 | 7.0.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Framework | from 5.3.0 before 5.3.49 from 6.1.0 before 6.1.28 from 6.2.0 before 6.2.18.1 from 7.0.0 before 7.0.7.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-mq64-j8f9-9gcj
- https://nvd.nist.gov/vuln/detail/CVE-2026-41841
- https://spring.io/security/cve-2026-41841
- https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19
- https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8