CVE-2026-22741: 
Apache Log4j vulnerability analysis and mitigation

CVE-2026-22741 is a static resource cache poisoning vulnerability in Spring MVC and Spring WebFlux applications. It was initially reported on April 17, 2026, and published to the NVD and GitHub Advisory Database on April 29, 2026. The vulnerability affects Spring Framework versions 5.3.0–5.3.47, 6.1.0–6.1.26, 6.2.0–6.2.17, and 7.0.0–7.0.6, as well as older unsupported versions. It carries a CVSS v3.1 base score of 3.1 (Low), reflecting high attack complexity and a requirement for user interaction (Spring Advisory, GitHub Advisory).

The root cause is classified as CWE-524 (Use of Cache Containing Sensitive Information), where the resource caching layer in Spring's static resource chain can be manipulated to store incorrectly encoded resources. Exploitation requires four simultaneous conditions: the application uses Spring MVC or WebFlux, the resource chain is configured with caching enabled, encoded resource resolution is supported, and the resource cache is empty at the time of the attack. An unauthenticated remote attacker can send crafted HTTP requests that cause the cache to be populated with resources using the wrong encoding, which then serves corrupted content to subsequent clients. The vulnerability is tracked under CAPEC-204 (Lifting Sensitive Data Embedded in Cache) (Spring Advisory, GitHub Advisory).

Successful exploitation results in a denial of service condition by breaking the front-end application for all clients served from the poisoned cache. There is no confidentiality or integrity impact — the vulnerability is limited to availability, and only at a low level given the constrained attack conditions. The scope is unchanged, meaning the impact is confined to the vulnerable application component itself without lateral movement potential (Spring Advisory, GitHub Advisory).

1. Reconnaissance: Identify Spring MVC or WebFlux applications that serve static resources with resource chain caching and encoded resource resolution enabled. This can be inferred from application behavior or framework version fingerprinting.
2. Wait for cache-empty state: The attack is only viable when the resource cache is empty (e.g., after application startup or cache expiration). Monitor or time requests accordingly.
3. Send malicious encoded request: Craft an HTTP request targeting a static resource endpoint with a manipulated encoding header or path that causes the resource resolver to select an incorrectly encoded resource variant.
4. Poison the cache: The malformed request causes the application to cache the resource with the wrong encoding, which is then served to all subsequent clients requesting that resource.
5. Trigger denial of service: Legitimate clients receive incorrectly encoded resources (e.g., wrong content-encoding), causing the front-end application to malfunction or fail to render correctly (Spring Advisory, GitHub Advisory).

• Network: Unusual HTTP requests to static resource endpoints with atypical Accept-Encoding headers or encoded path variants arriving shortly after application startup or cache reset events.
• Logs: Application logs showing static resource resolution selecting unexpected encoded variants (e.g., gzip or brotli variants served where not expected); repeated cache-miss followed by cache-store events for the same resource with differing encodings.
• Application Behavior: Front-end application failures or rendering errors reported by multiple clients simultaneously, particularly following application restarts or cache invalidation events, suggesting a poisoned cache state.

Users should upgrade to the fixed versions of Spring Framework: 7.0.7 (OSS), 6.2.18 (OSS), 6.1.27 (Commercial), or 5.3.48 (Commercial). No additional mitigation steps are required beyond upgrading. As a temporary workaround, organizations can disable encoded resource resolution support in the resource chain configuration if it is not required by the application, or restrict access to the application during cache initialization periods (Spring Advisory, GitHub Advisory). IBM has also released patches for affected products including IBM Library Support for Spring and IBM Business Automation Manager Open Editions (IBM Advisory).

The vulnerability was responsibly disclosed by Yuki Matsuhashi and rated LOW severity by the Spring team (Spring Advisory). HeroDevs published a blog post covering this CVE alongside other Spring Framework April 2026 web stack DoS and cache poisoning CVEs, providing additional context for the Spring ecosystem (HeroDevs Blog). Coverage in JVM Weekly and InfoQ Java news roundups indicates moderate community awareness, though the low severity rating and constrained exploitation conditions have limited broader concern.