CVE-2026-41842

This flaw lets a remote attacker bombard a Spring-based web app with specially crafted requests so the server spends too much effort processing “versioned” static files (like JavaScript, CSS, or web assets). Over time, that can overwhelm the server so the app becomes slow or stops responding, similar to how too many people hitting a busy website’s asset pages can cause the site to buckle.

This matters if your business runs a Spring Framework-based application (Spring MVC or WebFlux) that uses the affected version range and is configured to resolve versioned static resources. The attack does not require a login or any user action, meaning it can be attempted by anyone who can reach the application’s network endpoint. The findings do not confirm whether it’s reachable in default setups, so the practical risk depends on whether your application is set up to resolve versioned static resources and is exposed to the network.

This is AMBER: it’s a denial-of-service risk where an attacker can send unauthenticated network requests that make the app consume excessive resources. Even without public exploit code or confirmed real-world incidents in the findings, it’s important to fix because DoS issues can directly cause downtime.