CVE-2026-41841 is a medium severity vulnerability in the Spring Framework affecting versions 5.3.0 to 5.3.48, 6.1.0 to 6.1.27, 6.2.0 to 6.2.18, and 7.0.0 to 7.0.7. It involves the use of cache containing sensitive information during the resolution of static resources in Spring MVC and WebFlux applications, potentially leading to information disclosure. The vulnerability is categorized under CWE-524, which relates to the use of caches that contain sensitive information that can aid in security bypass. The CVSS vector indicates the attack is network-based with high attack complexity, no privileges or user interaction required, and impacts confidentiality but not integrity or availability. There is no vendor advisory or patch information available at this time.

Successful exploitation could lead to unauthorized disclosure of sensitive information cached during static resource resolution in affected Spring Framework applications. This could aid attackers in bypassing security controls. The vulnerability does not impact integrity or availability according to the CVSS vector. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor Spring Framework vendor communications for updates. Until a fix is available, consider reviewing application caching configurations related to static resource handling to minimize exposure of sensitive information.