CVE-2026-22745
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. The vulnerability occurs when the application uses Spring MVC or WebFlux, serves static resources from the file system, and runs on Windows. An attacker can send malicious requests that are slow to resolve and keep HTTP connections in use.
Risk Assessment
This can cause resource exhaustion and application unavailability (Denial of Service), affecting service continuity.
Recommendation
Update Spring Framework to a patched version. If updating is not possible, consider restricting static resource serving from the file system on Windows or implementing connection limiting mechanisms.
Other vulnerabilities in Spring Framework
See all- CVE-2014-0225High
The Spring Framework versions from 4.0.0 to 4.0.4 and from 3.0.0 to 3.2.8, as well as possibly earlier unsupported versions, did not disable by default the resolution of URI references in a DTD declaration when processing user-provided XML documents. This enabled an XXE attack.
- CVE-2026-59313Critical
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Affects Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, and 5.3.0-5.3.49.
- CVE-2026-59283Critical
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Affects multiple versions of Spring Framework.
- CVE-2026-47892Critical
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.5.RELEASE-5.2.25.RELEASE.
- CVE-2026-47891Critical
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.
- CVE-2026-47890Critical
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Affected versions: Spring Framework 7.0.0-7.0.8 and 6.2.0-6.2.19.
- CVE-2022-22968Medium
In Spring Framework versions 5.3.0-5.3.18, 5.2.0-5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
- CVE-2022-22965CriticalActively exploited
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment; applications deployed as Spring Boot executable jars are not vulnerable to this specific exploit, but the vulnerability is more general in nature.
- CVE-2022-22950Medium
In Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
- CVE-2020-5421Medium
In Spring Framework versions 5.2.0-5.2.8, 5.1.0-5.1.17, 5.0.0-5.0.18, 4.3.0-4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
Original NVD description (English source)
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the application is serving static resources from the file system * the application is running on a Windows platform When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS