Medium

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources

Disclosed: 29.04.2026
Updated: 11.10.2026 13:20

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.

More precisely, an application can be vulnerable when all the following are true:

the application is using Spring MVC or Spring WebFlux
the application is serving static resources from the file system
the application is running on a Windows platform

When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	org.springframework:spring-webflux	>= 7.0.0, < 7.0.7, >= 6.2.0, < 6.2.18, >= 6.1.0, <= 6.1.26, <= 5.3.47	7.0.7, 6.2.18
Java / Kotlin (Maven)	org.springframework:spring-webmvc	>= 7.0.0, < 7.0.7, >= 6.2.0, < 6.2.18, >= 6.1.0, <= 6.1.26, <= 5.3.47	7.0.7, 6.2.18

References

CVSS score 5.3/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness (CWE): CWE-400
Platform: Java / Kotlin (Maven)
Package: org.springframework:spring-webflux, org.springframework:spring-webmvc
Disclosed: 29.04.2026
Updated: 11.10.2026 13:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-6p4f-wcwh-5vvm - CC BY 4.0

Vulnerability history: org.springframework:spring-webflux

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (20) in the archive

Total entries: 20
First → latest: 01.2020 08.2026
Without a fix: 1
Exploited in attacks: 1

Severity breakdown

Critical 3
High 4
Medium 11
Low 2

Disclosures per year

2020: 2
2021: 0
2022: 1
2023: 0
2024: 2
2025: 0
2026: 15

27.08.2026

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

Critical · 9.8 CVE-2026-47892 >= 5.2.5.RELEASE, <= 5.2.25.RELEASE, >= 5.3.0, <= 5.3.49, >= 6.0.0, <= 6.0.30, >= 6.1.0, <= 6.1.28, >= 6.2.0, <= 6.2.19, >= 7.0.0, < 7.0.9 7.0.9
27.08.2026

Spring Framework Server Sent Event stream corruption while rendering fragments

Critical · 9.8 CVE-2026-47890 >= 6.2.0, <= 6.2.19, >= 7.0.0, < 7.0.9 7.0.9
09.06.2026

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

High · 7.5 CVE-2026-41842 >= 7.0.0, < 7.0.8, >= 6.2.0, < 6.2.19, >= 6.1.0, <= 6.1.21, <= 5.3.39 7.0.8, 6.2.19
29.04.2026

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources this entry

Medium · 5.3 CVE-2026-22745 >= 7.0.0, < 7.0.7, >= 6.2.0, < 6.2.18, >= 6.1.0, <= 6.1.26, <= 5.3.47 7.0.7, 6.2.18
19.12.2024

Spring Framework Path Traversal vulnerability

High · 7.5 CVE-2024-38819 >= 6.1.0, < 6.1.14, <= 5.3.40, >= 6.0.0, <= 6.0.24 6.1.14
13.09.2024

Path traversal vulnerability in functional web frameworks

High · 7.5 CVE-2024-38816 >= 6.1.0, < 6.1.13, >= 6.0.0, <= 6.0.23, >= 5.3.0, <= 5.3.39 6.1.13
31.03.2022

Remote Code Execution in Spring Framework

Critical · 9.8 Exploited in attacks CVE-2022-22965 < 5.2.20.RELEASE, >= 5.3.0, < 5.3.18 5.2.20.RELEASE, 5.3.18
21.01.2020

RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

High · 7.5 CVE-2020-5398 >= 5.2.0.RELEASE, < 5.2.3.RELEASE, >= 5.1.0.RELEASE, < 5.1.13.RELEASE, >= 5.0.0.RELEASE, < 5.0.16.RELEASE 5.2.3.RELEASE, 5.1.13.RELEASE, 5.0.16.RELEASE

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application