CVE-2026-22741 is an information exposure vulnerability (CWE-524) in VMware Spring Framework affecting versions 5.3.0, 6.1.0, 6.2.0, and 7.0.0. It arises when Spring MVC or WebFlux applications enable resource chain support with caching and encoded resource resolution. If the resource cache is empty when an attacker accesses the application, they can poison the cache with resources using incorrect encoding. This cache poisoning can lead to denial of service by disrupting the front-end application for users. The vulnerability requires network access, high attack complexity, no privileges, and user interaction, resulting in low impact on availability and no impact on confidentiality or integrity.

The vulnerability can cause a denial of service by breaking the front-end application for clients through cache poisoning with incorrectly encoded static resources. There is no impact on confidentiality or integrity. The low CVSS score (3.1) and vector indicate that exploitation requires user interaction and has high attack complexity, limiting the overall impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or guidance is available, review application configurations to avoid enabling resource chain caching with encoded resource resolution simultaneously, especially if the resource cache can be empty when exposed to untrusted users. Monitor vendor advisories for updates and apply patches promptly once released.