Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

🗓️ 09 Jun 2026 06:31:57Reported by GitHub Advisory DatabaseType

Spring Framework DoS via versioned static resource resolution in Spring MVC and WebFlux; affected versions.

Reporter	Title	Published	Views	Family All 66
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Framework vulnerability that could allow Information Disclosure, Denial of Service (Dos) attacks, and Path Traversal attacks	26 Jun 202618:21	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	6 Aug 202620:36	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Controller	21 Jul 202603:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC [CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846]	27 Jul 202620:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in spring-webmvc jar	27 Jul 202607:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	30 Jun 202610:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	22 Jul 202607:55	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring MVC and WebFlux affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	10 Jul 202603:53	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Spring-core affects IBM Netezza Appliance	7 Aug 202612:05	–	ibm

Vulners

Node

org.springframework spring-webfluxRange≤5.3.39maven

org.springframework spring-webmvcRange≤5.3.39maven

org.springframework spring-webfluxRange6.1.0–6.1.21maven

org.springframework spring-webmvcRange6.1.0–6.1.21maven

org.springframework spring-webfluxRange6.2.0–6.2.18maven

org.springframework spring-webmvcRange6.2.0–6.2.18maven

org.springframework spring-webfluxRange7.0.0–7.0.7maven

org.springframework spring-webmvcRange7.0.0–7.0.7maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41842
spring	www.spring.io/security/cve-2026-41842
github	www.github.com/spring-projects/spring-framework/releases/tag/v6.2.19
github	www.github.com/spring-projects/spring-framework/releases/tag/v7.0.8
github	www.github.com/advisories/GHSA-x23c-287f-qqv5

30 Jul 2026 15:27Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00399

SSVC

CWE-400