GHSA-wg35-8jpf-2xv3: Static resource cache poisoning in Spring MVC and WebFlux

Published Apr 29, 2026

Updated

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

More precisely, an application can be vulnerable when all the following are true:

the application is using Spring MVC or Spring WebFlux the application is configuring the resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with caching enabled the application adds support for encoded resources resolution the resource cache must be empty when the attacker has access to the application

When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.

Affected Software

1 affected component

VMware Spring Framework

Event History

Apr 29, 2026

CVE Published

via OSV·11:32 AM

Data Sourced

via OSV·11:32 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Exposure requires Spring MVC or Spring WebFlux, resource-chain support configured with caching enabled, and support for encoded-resource resolution. The resource cache must also be empty when an attacker can access the application.

What does an attacker need to exploit it?

An attacker needs network access to send malicious requests while the affected application's resource cache is empty. No privileges are required, but exploitation depends on the specific resource-chain and encoded-resource configuration.

Are default Spring MVC or WebFlux applications affected?

The issue applies only when resource-chain caching and encoded-resource resolution have been configured. The provided information does not indicate that these conditions are enabled by default.

What is the practical impact of successful cache poisoning?

Poisoned cache entries can cause resources to be served with the wrong encoding. This can break the front-end application for clients, resulting in denial of service.

GHSA-wg35-8jpf-2xv3: Static resource cache poisoning in Spring MVC and WebFlux

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Are default Spring MVC or WebFlux applications affected?

What is the practical impact of successful cache poisoning?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Are default Spring MVC or WebFlux applications affected?

What is the practical impact of successful cache poisoning?