CVE-2026-41842: VMware Spring Framework DoS Vulnerability

CVE-2026-41842 Overview

CVE-2026-41842 is a denial of service vulnerability affecting Spring MVC and Spring WebFlux applications when resolving static resources. The flaw resides in the Spring Framework maintained by VMware and is classified under [CWE-400] Uncontrolled Resource Consumption. An unauthenticated remote attacker can send crafted requests for static resources to exhaust application resources, rendering the service unavailable to legitimate users. The vulnerability impacts Spring Framework versions 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.

Critical Impact
Unauthenticated attackers can trigger denial of service conditions against Spring MVC and WebFlux applications by abusing static resource resolution, disrupting availability of production web services.

Affected Products

Spring Framework 7.0.0 through 7.0.7
Spring Framework 6.2.0 through 6.2.18
Spring Framework 6.1.0 through 6.1.27
Spring Framework 5.3.0 through 5.3.48

Discovery Timeline

2026-06-09 - CVE-2026-41842 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-41842

Vulnerability Analysis

The vulnerability affects Spring MVC and Spring WebFlux applications during static resource resolution. Both web stacks expose resource handlers that map incoming HTTP request paths to files served from the classpath, filesystem, or other configured locations. When an attacker sends specifically crafted requests targeting these handlers, the resolution logic consumes excessive resources without producing a useful response.

The attack does not require authentication, user interaction, or elevated privileges. A remote attacker only needs network reachability to a vulnerable endpoint that serves static content. Because Spring Framework underpins a large portion of Java enterprise web applications, the exposure surface is broad.

The consequence is loss of availability. The vulnerability does not affect confidentiality or integrity, but a sustained attack can render web tiers unresponsive and cascade into upstream load balancers and dependent services.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400] in the static resource resolution path. The resolver does not adequately constrain the work performed when handling certain request patterns, allowing a low-cost client request to translate into disproportionate server-side processing.

Attack Vector

The attack vector is network-based. An attacker sends HTTP requests targeting URL patterns mapped to Spring's static resource handlers, such as paths configured through ResourceHandlerRegistry or default resource locations under /static/, /public/, /resources/, and /META-INF/resources/. Repeated or concurrent requests amplify the resource exhaustion, leading to denial of service. Refer to the Spring Security Advisory CVE-2026-41842 for vendor-specific technical details.

Detection Methods for CVE-2026-41842

Indicators of Compromise

Sustained spikes in CPU, heap usage, or thread pool saturation in Spring MVC or WebFlux applications without a corresponding increase in legitimate traffic.
High volumes of HTTP requests targeting static resource paths such as /static/, /resources/, /webjars/, or other URL prefixes registered via ResourceHandlerRegistry.
Increased response latency or HTTP 5xx errors originating from servlet containers (Tomcat, Jetty) or Netty-based reactive runtimes hosting Spring applications.

Detection Strategies

Inventory all applications using Spring Framework 5.3.x, 6.1.x, 6.2.x, or 7.0.x and verify whether they expose static resource handlers to untrusted networks.
Inspect web access logs for repeated requests to static resource URLs from a small set of source IPs or with unusual path patterns.
Correlate application performance monitoring (APM) metrics with web server logs to identify request patterns that disproportionately consume CPU or memory.

Monitoring Recommendations

Configure alerts on thread pool exhaustion, request queue depth, and JVM garbage collection pressure for Spring-based services.
Track HTTP request rates per URL prefix at the reverse proxy or WAF layer and alert on anomalous growth against static asset endpoints.
Forward web server, application, and JVM telemetry to a centralized SIEM or data lake for cross-source correlation during suspected DoS events.

How to Mitigate CVE-2026-41842

Immediate Actions Required

Upgrade Spring Framework to a fixed version as published in the Spring Security Advisory CVE-2026-41842.
Identify internet-exposed Spring MVC and WebFlux services and prioritize patching those endpoints first.
Apply rate limiting and request size limits at the reverse proxy, API gateway, or WAF in front of vulnerable applications until patches are deployed.

Patch Information

VMware has published a security advisory addressing CVE-2026-41842. Administrators should upgrade affected Spring Framework deployments to the patched releases referenced in the Spring Security Advisory CVE-2026-41842. Update dependent artifacts in Maven or Gradle build configurations and redeploy all affected services after validating compatibility in staging.

Workarounds

Restrict access to static resource endpoints using network controls, authentication, or WAF rules where business requirements permit.
Place a CDN or caching layer in front of Spring applications to absorb static resource traffic and reduce origin server load.
Tune servlet container or Netty thread pools, connection limits, and request timeouts to contain the impact of resource exhaustion attempts.

bash

# Example: update Spring Framework version in Maven (replace with fixed version from advisory)
mvn versions:set-property -Dproperty=spring-framework.version -DnewVersion=<PATCHED_VERSION>
mvn clean verify