CVE-2026-22741: Static resource cache poisoning in Spring MVC and WebFlux
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.
More precisely, an application can be vulnerable when all the following are true:
the application is using Spring MVC or Spring WebFlux the application is configuring the resource chain support
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22741?
CVE-2026-22741 is considered a critical vulnerability affecting Spring MVC and Spring WebFlux applications.
How do I fix CVE-2026-22741?
To mitigate CVE-2026-22741, ensure proper validation and sanitization of cache entries for static resources in your application.
What types of applications are affected by CVE-2026-22741?
CVE-2026-22741 affects applications using Spring MVC and Spring WebFlux that resolve static resources.
What is cache poisoning as described in CVE-2026-22741?
Cache poisoning in the context of CVE-2026-22741 refers to an attacker being able to manipulate cache entries, leading to unintended responses for static resources.
Is CVE-2026-22741 remotely exploitable?
Yes, CVE-2026-22741 can be exploited remotely by attackers targeting the vulnerable Spring MVC and WebFlux applications.