CVE-2026-41842: Spring Framework Denial of Service Vulnerability in Spring MVC and WebFlux
Summary
CVE-2026-41842: Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux. Affects org.springframework:spring-webmvc across 4 version ranges.
< 5.3.39
>= 6.1.0, <= 6.1.21
>= 6.2.0, < 6.2.19
>= 7.0.0, < 7.0.8
Fixed in 5.3.39, 6.2.19 or 7.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Spring Framework is a powerful framework for building Java applications, particularly web applications. It provides comprehensive infrastructure support for developing Java applications. Spring MVC and WebFlux are modules within the Spring Framework that facilitate the creation of web applications. However, certain versions of these modules are vulnerable to Denial of Service (DoS) attacks when resolving static resources, which can lead to service disruption.
Vulnerability Detail
The vulnerability arises from the way Spring MVC and WebFlux handle versioned resources. Attackers can exploit this flaw to trigger excessive resource consumption, potentially leading to service outages. This vulnerability affects multiple versions of the Spring Framework, specifically versions 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.3.395.3.39 -
>= 6.2.0, < 6.2.196.2.19 -
>= 7.0.0, < 7.0.87.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, consider implementing rate limiting on your server to mitigate the impact of potential DoS attacks. This can be done by configuring your web server or application server to limit the number of requests from a single IP address.
Conclusion
CVE-2026-41842 is a significant vulnerability affecting multiple versions of the Spring Framework, specifically in the Spring MVC and WebFlux modules. It poses a risk of Denial of Service attacks, which can disrupt services. It is crucial to update to the patched versions to mitigate this risk.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
CVE-2026-41842 is a vulnerability in the Spring Framework that allows for Denial of Service attacks through improper handling of versioned resources in Spring MVC and WebFlux.
Affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your pom.xml, Vulert can help you determine if your application is affected by this vulnerability.
The CVSS score for CVE-2026-41842 is 7.5, indicating a high severity level.
If you cannot update your Spring Framework version immediately, consider implementing rate limiting on your server to reduce the risk of a DoS attack.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
