VDB
GHSA-wg35-8jpf-2xv3
GHSA-wg35-8jpf-2xv3
PUBLISHED
CVSS 3.0999999046325684 LOW
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.
Risk Scores
CVSS 3.1
3.0999999046325684
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Maven | org.springframework:spring-webflux | 7.0.0, 6.1.0, 0 |
| Maven | org.springframework:spring-webmvc | 6.2.0, 6.1.0, 0 |
Timeline
- Apr 29, 2026 CVE Published
- May 8, 2026 CVE Updated
- May 18, 2026 Security Advisory