CVE-2026-41841: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-41841 is an information disclosure vulnerability in Spring Framework affecting Spring MVC and WebFlux applications when resolving static resources. It was disclosed on June 8–9, 2026, and affects Spring Framework versions 7.0.0–7.0.7, 6.2.0–6.2.18, 6.1.0–6.1.27, and 5.3.0–5.3.48. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) (Spring Advisory, GitHub Advisory).

The root cause is classified as CWE-524 (Use of Cache Containing Sensitive Information), where a shared resource cache used across multiple resource handlers can serve protected resources to unauthorized users. Exploitation requires a specific configuration: the application must use Spring MVC or WebFlux, configure multiple resource handlers with different locations, have at least one handler requiring authentication, and use a shared cache across those handlers. When a publicly accessible resource with the same name as a protected resource is resolved and cached first, a subsequent request for the protected resource may be served from the cache without enforcing authentication. No public proof-of-concept code has been identified (Spring Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to read sensitive files or protected resources that should require authentication, resulting in a high confidentiality impact with no effect on integrity or availability. The attack is limited to the scope of the vulnerable application's static resource configuration and does not directly enable code execution or lateral movement. The risk is highest in applications that serve both public and authenticated static content from a shared cache (Spring Advisory, GitHub Advisory).

1. Reconnaissance: Identify Spring MVC or WebFlux applications that serve both public and authenticated static resources, potentially by reviewing publicly accessible endpoints or application documentation.
2. Identify shared cache configuration: Determine whether the target application uses a shared resource cache across multiple resource handlers with differing access controls (e.g., by observing HTTP caching headers or application behavior).
3. Trigger public resource caching: Send a request for a publicly accessible static resource whose name matches a protected resource, causing it to be stored in the shared cache.
4. Access protected resource: Send a subsequent unauthenticated request for the protected resource by the same name; the application serves the cached (public) response instead of enforcing authentication, disclosing the protected content (Spring Advisory).

• Network: Repeated unauthenticated HTTP GET requests to static resource endpoints that are normally protected by authentication, particularly from the same source IP in rapid succession.
• Logs: Application access logs showing unauthenticated requests successfully returning HTTP 200 responses for resources that should return HTTP 401 or 403; cache hit indicators in application or proxy logs for protected resource paths.
• Application Behavior: Unexpected cache hits for resources under authenticated resource handler paths; discrepancies between access control enforcement and actual resource delivery in Spring application logs.

Users should upgrade Spring Framework to the corresponding fixed versions: 7.0.8 (OSS) or 7.0.7.1 (Commercial), 6.2.19 (OSS) or 6.2.18.1 (Commercial), 6.1.28 (Commercial), or 5.3.49 (Commercial). No additional mitigation steps are required after upgrading. As a temporary workaround prior to patching, administrators should review and avoid using a shared cache across resource handlers with differing authentication requirements, or restrict network-level access to the Spring application (Spring Advisory, GitHub Advisory).

The vulnerability was discovered internally by the Spring team and disclosed on June 8, 2026, with patches released simultaneously. Security monitoring platforms including Tenable and SecurityOnline.info covered the disclosure shortly after publication. No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability tracking and aggregation (Spring Advisory).