CVE-2026-22741

the application is using Spring MVC or Spring WebFlux
the application is configuring the resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with caching enabled
the application adds support for encoded resources resolution
the resource cache must be empty when the attacker has access to the application

When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.0.7"
                },
                {
                    "introduced": "6.2.0"
                },
                {
                    "fixed": "6.2.18"
                },
                {
                    "introduced": "6.1.0"
                },
                {
                    "fixed": "6.1.27"
                },
                {
                    "introduced": "5.3.0"
                },
                {
                    "fixed": "5.3.48"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-524"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22741.json",
    "cna_assigner": "vmware"
}

References

Affected packages

Git / github.com/spring-projects/spring-framework

Affected ranges

Type

GIT

Repo

https://github.com/spring-projects/spring-framework

Events

Introduced

5024bb72279188f1d0dcfe19e8abdd4bdb9887c8

Fixed

6b117247d383294662e199c6b47d7bf54c49caaa

Introduced

fe00848be255db1455f0189d9ff28661f301be36

Fixed

c997d4018d3dc6a7dde2e20eae3627599a01e169

Database specific

{
    "extracted_events": [
        {
            "introduced": "6.2.0"
        },
        {
            "fixed": "6.2.18"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.7"
        }
    ],
    "source": "CPE_FIELD",
    "cpe": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22741.json"