CVE-2026-41842 is an uncontrolled resource consumption vulnerability (CWE-400) in the Spring Framework affecting versions 5.3.0 to 5.3.48, 6.1.0 to 6.1.27, 6.2.0 to 6.2.18, and 7.0.0 to 7.0.7. The issue arises in Spring MVC and WebFlux applications during the resolution of static resources, which can be exploited to cause denial of service by exhausting resources. The vulnerability has a CVSS score of 7.5, indicating high severity, with no confidentiality or integrity impact but a significant impact on availability. As of the provided data, no official fix or patch has been published, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to denial of service conditions in affected Spring MVC and WebFlux applications by causing uncontrolled resource consumption during static resource resolution. This impacts the availability of the affected applications but does not affect confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users should monitor Spring Framework advisories for updates. Until a fix is available, consider limiting exposure of vulnerable endpoints and applying any recommended configuration changes from the vendor if published.