This vulnerability affects Spring MVC and WebFlux applications running on Windows that serve static resources from the file system. An attacker can exploit this by sending specially crafted requests that are slow to resolve, which keeps HTTP connections occupied and leads to Denial of Service conditions. The issue is classified under CWE-400 (Uncontrolled Resource Consumption). It impacts multiple Spring Framework versions starting from 5.3.0 through 7.0.0. The CVSS v3.1 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Successful exploitation results in Denial of Service by exhausting server resources through slow resolution of static resource requests on affected Spring Framework applications running on Windows. There is no impact on confidentiality or integrity, only availability is affected. No known exploits in the wild have been reported.

Patch status is not yet confirmed — no official fix or remediation level has been published by VMware as of the provided data. Users should monitor the vendor advisory for updates. In the meantime, consider mitigating exposure by limiting access to static resource endpoints or deploying rate limiting and connection timeouts at the application or network level to reduce the risk of resource exhaustion.