CVE-2026-41841 Overview
CVE-2026-41841 is an information disclosure vulnerability affecting Spring MVC and WebFlux applications during static resource resolution. The flaw resides in the Spring Framework, maintained by VMware (Broadcom), and impacts a wide range of supported branches. An unauthenticated remote attacker can craft requests that cause the framework to expose sensitive file contents that should not be reachable through the static resource handler.
The issue is classified under [CWE-524] (Use of Cache Containing Sensitive Information). According to the Spring Security advisory, affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.
Critical Impact
Remote, unauthenticated attackers can disclose confidential file contents from Spring MVC and WebFlux applications by abusing static resource resolution logic.
Affected Products
- Spring Framework 7.0.0 through 7.0.7
- Spring Framework 6.2.0 through 6.2.18 and 6.1.0 through 6.1.27
- Spring Framework 5.3.0 through 5.3.48
Discovery Timeline
- 2026-06-09 - CVE-2026-41841 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-41841
Vulnerability Analysis
The vulnerability affects how Spring MVC and Spring WebFlux resolve static resources served from configured resource locations. An attacker can construct HTTP requests that cause the resource resolver to return file contents the application did not intend to expose. Because the attack only requires network access and no authentication, any internet-facing Spring application using the static resource handler is reachable.
The CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N vector indicates an attacker can read high-confidentiality data, while integrity and availability remain intact. The high attack complexity reflects the specific conditions needed in the resource handler configuration for disclosure to succeed.
Disclosed data may include application configuration, source files, credentials embedded in resource paths, or other internal artifacts colocated with served static content. The impact scales with how sensitive the data accessible from the configured resource roots is.
Root Cause
The defect lies in the static resource resolution logic shared by Spring MVC and WebFlux. The resolver does not adequately constrain which resources can be returned under certain configurations, allowing requests to reach paths outside the intended public surface. This aligns with [CWE-524], where data that should remain protected becomes retrievable through a caching or resolution layer.
Attack Vector
Exploitation is performed over the network by sending crafted HTTP requests to endpoints handled by the Spring static resource handler. No user interaction or prior authentication is required. The attacker iterates on path patterns recognized by the resolver to enumerate and retrieve sensitive resources. Refer to the Spring Security advisory for CVE-2026-41841 for technical specifics.
Detection Methods for CVE-2026-41841
Indicators of Compromise
- Unusual HTTP GET requests targeting static resource paths with traversal-like patterns or unexpected file extensions
- Repeated 200 OK responses to resource requests that return non-public files such as configuration or source artifacts
- Spikes in response sizes for endpoints normally serving small static assets
Detection Strategies
- Inspect web server and application access logs for requests to /static/, /resources/, or custom resource mappings that resolve to sensitive files
- Compare returned content types and sizes against an allowlist of expected static assets
- Deploy WAF rules that flag suspicious encodings, traversal sequences, and unusual paths against Spring application routes
Monitoring Recommendations
- Forward Spring application access logs and WAF telemetry to a centralized analytics platform for correlation
- Alert on anomalous read volumes from a single source IP against static resource endpoints
- Track Spring Framework version inventory to identify unpatched services exposed to the internet
How to Mitigate CVE-2026-41841
Immediate Actions Required
- Upgrade Spring Framework to a fixed release line as listed in the vendor advisory
- Inventory all applications using Spring MVC or WebFlux and verify the framework version in use
- Restrict internet exposure of applications until patching is complete, particularly those serving static resources
Patch Information
VMware (Broadcom) has published fixed releases for each affected branch. Consult the Spring Security advisory for CVE-2026-41841 for the exact patched versions corresponding to 5.3.x, 6.1.x, 6.2.x, and 7.0.x. Apply the upgrade through your build system by updating the spring-webmvc and spring-webflux dependency coordinates.
Workarounds
- Reduce the scope of configured static resource locations so only intended public assets are reachable
- Place reverse proxy or WAF rules in front of Spring applications to block requests with traversal patterns or unexpected file extensions
- Disable static resource handling on services that do not require it
# Configuration example
# Update Maven dependency to a patched Spring Framework release
mvn versions:set-property -Dproperty=spring-framework.version -DnewVersion=6.2.19
mvn -U clean verify
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
