CVE-2026-41841 describes an information disclosure vulnerability in Spring Framework's MVC and WebFlux modules when resolving static resources. The issue involves the use of cache containing sensitive information, which may be leveraged to bypass security controls. Affected versions include 5.3.0 to 5.3.48, 6.1.0 to 6.1.27, 6.2.0 to 6.2.18, and 7.0.0 to 7.0.7. The vulnerability has a CVSS 3.1 base score of 5.9, with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact but no integrity or availability impact. No official remediation or patch information is provided in the available data.

Successful exploitation can lead to disclosure of sensitive information cached during static resource resolution in Spring MVC and WebFlux applications. This information disclosure could aid attackers in bypassing security mechanisms. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Spring Framework vendor advisories for updates. Until a patch is available, consider restricting access to static resources or applying compensating controls to limit exposure of sensitive cached data.