Detections
Analytics

SCA: security update for org.springframework:spring-webflux, org.springframework:spring-webmvc (GHSA-wg35-8jpf-2xv3)

low Tenable Cloud Security Plugin ID 441392

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.
 More precisely, an application can be vulnerable when all the following are true: * the application is
 using Spring MVC or Spring WebFlux * the application is configuring the resource chain support
 https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title
 with caching enabled * the application adds support for encoded resources resolution * the resource cache
 must be empty when the attacker has access to the application When all the conditions above are met, the
 attacker can send malicious requests and poison the resource cache with resources using the wrong
 encoding. This can cause a denial of service by breaking the front-end application for clients.
 (CVE-2026-22741)

Solution

Update the org.springframework:spring-webflux library and its related packages to version 6.2.18 or later.

See Also

https://github.com/advisories/GHSA-wg35-8jpf-2xv3

Plugin Details

Severity: Low

ID: 441392

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 5/7/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-22741

CVSS v3

Risk Factor: Low

Base Score: 3.1

Temporal Score: 2.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/29/2026

Vulnerability Publication Date: 4/29/2026

Reference Information

CVE: CVE-2026-22741

cwe: CWE-524