3.1

CVE-2026-22741: vmware spring_framework

CVSS: 3.1v3.1LowAnalyzed
AliasesUBUNTU-CVE-2026-22741DEBIAN-CVE-2026-22741CGA-37p3-7mxv-8964
Published 29-04-2026Last modified 29-04-2026
Open JSON

Vulnerability summary

CVE-2026-22741 is a low (CVSS 3.1) vulnerability in vmware spring_framework. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.6% of scored vulnerabilities.

Overall risk
12/100
0100
Low · default modelHow is this calculated?
CVSS score
3.1/10
010
Low · v3.1 (CVE.org)
EPSS score
0.24%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-85XP-6FW4-28G9

Timeline

  1. 29-04-2026
    PublishedVulnerability first disclosed.
  2. 29-04-2026
    Last modifiedVulnerability information updated.

Description

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabled * the application adds support for encoded resources resolution * the resource cache must be empty when the attacker has access to the application When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

0.00 pp

From 0.24% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard29 products
  • apache-activemq-5.19All versions (No fix recorded)
  • apache-activemq-6.1< 6.1.8-r5
  • apache-activemq-6.2< 6.2.5-r3
  • apache-activemq-fips-5.19All versions (No fix recorded)
  • apache-activemq-fips-6.1< 6.1.8-r7
Wolfi3 products
  • apache-nifi-registry< 2.9.0-r8
  • thingsboard-tb-mqtt-transport< 4.3.1.1-r11
  • thingsboard-tb-node< 4.3.1.1-r11
Org.springframework2 products
  • spring-webflux≥ 7.0.0, < 7.0.7 | ≥ 6.2.0, < 6.2.18 | ≥ 6.1.0, ≤ 6.1.26 | ≤ 5.3.47
  • spring-webmvc≥ 7.0.0, < 7.0.7 | ≥ 6.2.0, < 6.2.18 | ≥ 6.1.0, ≤ 6.1.26 | ≤ 5.3.47
Debian1 product
  • libspring-javaAll versions (No fix recorded)
Ubuntu1 product
  • libspring-javaAll versions (No fix recorded)
Vmware1 product
  • spring_framework≥ 5.3.0, < 5.3.48 | < 5.3.48 | ≥ 6.1.0, < 6.1.27 | ≥ 6.2.0, < 6.2.18 | ≥ 7.0.0, < 7.0.7

6 vendors · 37 products

References

8 links