MEDIUM🇵🇱 Wersja polska

CVE-2026-41841

CVSS 5.9v3.1pub. 2026-06-09upd. 2026-06-27

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

  • VMware Spring Framework

    APP
    Vmware
    5.3.0 – 5.3.49 (bez)6.1.0 – 6.1.28 (bez)6.2.0 – 6.2.19 (bez)7.0.0 – 7.0.8 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-22965CRITICAL9.8⚠ KEVten sam produkt

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) ...

CVE-2023-44794CRITICAL9.8ten sam produkt

An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a cr...

CVE-2016-1000027CRITICAL9.8ten sam produkt

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for...

CVE-2018-1275CRITICAL9.8ten sam produkt

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions,...

CVE-2018-1270CRITICAL9.8ten sam produkt

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions,...