Spring Framework CVE-2026-41842: Overview of Versioned Resource DoS Affecting MVC and WebFlux

Introduction

A newly disclosed denial-of-service vulnerability in Spring Framework lets remote, unauthenticated attackers exhaust an application's HTTP connection pool with crafted requests that make static resource resolution slow. Snyk's ecosystem report found that 60% of Java developers use Spring Framework for their main applications, so the potential blast radius of CVE-2026-41842 is significant. Exploitation does depend on one specific configuration: versioned resources support must be enabled.

This is the fourth DoS issue in Spring MVC and WebFlux static resource handling disclosed in 2026. Three related CVEs (CVE-2026-22740, CVE-2026-22741, CVE-2026-22745) were published in April. The pattern suggests that static resource serving in Spring's web stack has become a recurring attack surface, and one worth reviewing as a whole.

Technical Information

Root Cause and Classification

CVE-2026-41842 is classified under CWE-400: Uncontrolled Resource Consumption, the weakness where a product does not properly control the number or size of the resources it allocates, which degrades performance and can deny service. The CVSS v3.1 score is 7.5, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The attack works over the network, has low complexity, and needs no privileges or user interaction. Its impact on availability is high, with no impact on confidentiality or integrity.

The vulnerability is in the static resource resolution layer that Spring MVC and Spring WebFlux share. When versioned resource resolution is enabled (through the VersionResourceResolver in the resource chain), the framework does extra work to resolve resource paths that contain version identifiers. Crafted requests can abuse that work to make filesystem resolution pathologically slow.

Preconditions for Exploitation

An application is vulnerable only when all three of these conditions are true at the same time:

1. The application uses Spring MVC or Spring WebFlux.
2. It serves static resources from the file system.
3. It has configured versioned resources support (the VersionResourceResolver).

Organizations that do not use versioned resource resolution are not affected.

Attack Flow

The attack belongs to the slow loris class:

1. The attacker identifies a Spring MVC or WebFlux application that serves versioned static resources from the filesystem.
2. The attacker crafts malicious HTTP requests aimed at the versioned resource resolution path, built to trigger slow filesystem resolution inside the VersionResourceResolver.
3. Each request holds its HTTP connection open for a long time while the slow resolution finishes.
4. The attacker opens many of these connections at once and gradually uses up the application's available connection pool.
5. Once the pool is exhausted, the application can no longer accept new connections from legitimate users, and service is denied.

The Spring advisory puts it this way: "an attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use, potentially leading to Denial of Service in the application."

This matches what HeroDevs called a "textbook slow loris class DoS" in its analysis of the closely related CVE-2026-22745, which affects exactly the same versions. The difference is the target. CVE-2026-41842 goes after the versioned resource resolution path, while the April 2026 CVEs targeted multipart request handling (CVE-2026-22740), cache poisoning through encoded resources (CVE-2026-22741), and Windows-specific static resource resolution (CVE-2026-22745).

Discovery

The Spring advisory says "this issue was discovered internally" by the Spring team, which indicates that no external researcher or threat actor reported it before the coordinated disclosure on June 8, 2026.

Patch Information

The Spring team patched CVE-2026-41842 in a coordinated release on June 8, 2026. The same batch addressed 17 other CVEs. The fix shipped in these versions:

The patch changes how versioned resource requests are resolved, which closes the pathological slow path attackers could use to pin connections. The advisory from VMware (Spring's CNA) gives upgrading as the sole remediation and says that "no further mitigation steps are necessary."

Commercial releases are available through a Tanzu Spring commercial subscription.

Important Timeline Consideration

Version 6.2.19 is likely the last open source release of the 6.2.x line, because that branch reaches OSS end of life on June 30, 2026. Teams on 6.2.x should take this upgrade now and plan their migration to the 7.0.x line. Spring Framework 6.1.x and 5.3.x are both past their OSS end-of-life dates, so organizations still running them have no free upstream patch. Their only options are to upgrade to a supported OSS line (6.2.x or 7.0.x) or to get commercial support.

Interim Defensive Measures

Organizations that cannot upgrade right away can use infrastructure-level mitigations. Because this is a slow loris attack, these may provide some protection:

• HTTP connection timeout enforcement at the reverse proxy or load balancer layer
• Connection rate limiting per source IP
• Monitoring for unusual connection counts or long connection durations
• Checking whether versioned resources support can be turned off temporarily (this may break front-end caching strategies)

The Spring advisory does not specifically recommend these measures. They follow established defenses against slow loris attacks.

Affected Systems and Versions

The vulnerability affects Spring Framework across four release trains:

• Spring Framework 7.0.0 through 7.0.7
• Spring Framework 6.2.0 through 6.2.18
• Spring Framework 6.1.0 through 6.1.27
• Spring Framework 5.3.0 through 5.3.48

The advisory adds that "versions that are no longer supported are also affected."

The vulnerable configuration requires all three of these:

1. Spring MVC or Spring WebFlux is in use.
2. Static resources are served from the file system.
3. Versioned resources support is configured (through VersionResourceResolver).

Applications that do not meet all three conditions are not vulnerable.

Vendor Security History

Spring Framework has a well-documented history of security vulnerabilities. The Spring security advisories page lists 22 pages of advisories across the Spring portfolio. These entries help put CVE-2026-41842 in context:

Spring4Shell is the most significant precedent. It was a zero-day RCE vulnerability that exploited classLoader manipulation in Spring MVC applications on JDK 9+. Proof-of-concept code spread quickly, and security organizations confirmed active scanning and exploitation within days of disclosure. CVE-2026-41842 is a DoS rather than an RCE, but Spring is high profile, and exploit development tends to move quickly once details are public.

Four DoS vulnerabilities in Spring MVC/WebFlux static resource handling arrived within two months (April and June 2026), which suggests this part of the codebase needs continued security scrutiny. Teams that applied the April patches and upgraded to 6.2.19 or 7.0.8 are already protected against this June CVE as well.

References

• CVE-2026-41842: Spring Framework Denial of Service via Versioned Resources
• CVE-2026-41842 Detail (NVD)
• Spring Framework 7.0.8 and 6.2.19 Available Now
• Spring Framework April 2026: 3 Web Stack DoS and Cache Poisoning CVEs (HeroDevs)
• CWE-400: Uncontrolled Resource Consumption
• Spring Dominates the Java Ecosystem (Snyk)
• Spring Security Advisories
• Spring4Shell: Zero Day Vulnerability in Spring Framework (Rapid7)
• CVE-2026-22741 Vulnerability Directory (HeroDevs)
• CISA Adds Three Known Exploited Vulnerabilities to Catalog (May 2026)
• 2026 Vulnerability Exploitation in the Wild (Proofpoint)