CVE-2026-22741

Summary

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

Severity

low

EPSS

0.2% (p14)

Also known as

GHSA-wg35-8jpf-2xv3#org.springframework:spring-webflux, GHSA-wg35-8jpf-2xv3#org.springframework:spring-webmvc

Published

2026-04-29

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-22741
• https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title
• https://github.com/spring-projects/spring-framework

Related advisories

• CVE-2022-22965 — critical · Maven/org.springframework:spring-webflux
• CVE-2024-38819 — high · Maven/org.springframework:spring-webflux
• CVE-2024-38816 — high · Maven/org.springframework:spring-webflux
• CVE-2026-22745 — medium · Maven/org.springframework:spring-webflux
• CVE-2026-22737 — medium · Maven/org.springframework:spring-webflux

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity