CVE-2026-22745

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22745
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22745.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-22745
Aliases
Downstream
Published
2026-04-29T11:35:21.947Z
Modified
2026-07-17T21:07:37.633043448Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
CVE-2026-22745 : Denial of service in static resource handling on Windows platforms
Details

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.

More precisely, an application can be vulnerable when all the following are true:

  • the application is using Spring MVC or Spring WebFlux
  • the application is serving static resources from the file system
  • the application is running on a Windows platform

When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.0.7"
                },
                {
                    "introduced": "6.2.0"
                },
                {
                    "fixed": "6.2.18"
                },
                {
                    "introduced": "6.1.0"
                },
                {
                    "fixed": "6.1.27"
                },
                {
                    "introduced": "5.3.0"
                },
                {
                    "fixed": "5.3.48"
                }
            ]
        }
    ],
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22745.json",
    "cwe_ids": [
        "CWE-400"
    ]
}
References

Affected packages

Git / github.com/spring-projects/spring-framework

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-framework
Events
Introduced
5024bb72279188f1d0dcfe19e8abdd4bdb9887c8
Fixed
6b117247d383294662e199c6b47d7bf54c49caaa
Introduced
fe00848be255db1455f0189d9ff28661f301be36
Fixed
c997d4018d3dc6a7dde2e20eae3627599a01e169
Database specific 
{
    "source": "CPE_FIELD",
    "cpe": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.2.0"
        },
        {
            "fixed": "6.2.18"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.7"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22745.json"