https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 07:03:19 +0000 https://vulnerability.circl.lu/vuln/cve-2026-22741 <p><strong>Affected:</strong> VMware Spring Framework</p> <p>Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.</p> <p>More precisely, an application can be vulnerable when all the following are true:</p> <p>* the application is using Spring MVC or Spring WebFlux * the application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabled * the application adds support for encoded resources resolution * the resource cache must be empty when the attacker has access to the application</p> <p>When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.</p> <p><strong>Affected:</strong> VMware Spring Framework</p> <p>Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.</p> <p>More precisely, an application can be vulnerable when all the following are true:</p> <p>* the application is using Spring MVC or Spring WebFlux * the application is configuring the  resource chain support https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with caching enabled * the application adds support for encoded resources resolution * the resource cache must be empty when the attacker has access to the application</p> <p>When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.</p> https://vulnerability.circl.lu/vuln/cve-2026-22741