GHSA-WG35-8JPF-2XV3 Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

🗓️ 29 Apr 2026 12:33:07Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Spring MVC or WebFlux with caching and encoded resource resolution is vulnerable to cache poisoning when the cache is empty.

Reporter	Title	Published	Views	Family All 46
IBM Security Bulletins	Security Bulletin: Due to use of spring-webmvc-6.2.17.jar, IBM Sterling Connect:Direct Web Services is vulnerable to cache poisoning when resolving static resources.	2 Jun 202611:46	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Use of Cache Containing Sensitive Information (CVE-2026-22741)	15 Jun 202620:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	24 May 202615:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	24 May 202615:08	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses uuid-11.1.0.tgz and spring-webmvc-6.2.17.jar which are vulnerable to CVE-2026-41988 and CVE-2026-22741.	27 May 202616:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for May 2026	12 Jun 202622:52	–	ibm
ATTACKERKB	CVE-2026-22741	29 Apr 202611:32	–	attackerkb
Chainguard	CVE-2026-22741 vulnerabilities	8 May 202607:18	–	cgr
Circl	CVE-2026-22741	20 Apr 202612:25	–	circl
CNNVD	VMware Spring Framework 安全漏洞	29 Apr 202600:00	–	cnnvd

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-22741
docs	www.docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html
github	www.github.com/spring-projects/spring-framework
spring	www.spring.io/security/cve-2026-22741

02 Jul 2026 21:30Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.13.1

EPSS0.00236