This vulnerability (CVE-2026-41842) in the Spring Framework arises from uncontrolled resource consumption (CWE-400) when resolving static resources in Spring MVC and WebFlux applications. Affected versions include Spring Framework 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. The issue can be exploited remotely without authentication (CVSS vector: AV:N/AC:L/PR:N/UI:N) to cause denial of service by exhausting resources. The CVSS v3.1 base score is 7.5, indicating high severity. No patch or official remediation guidance is currently available from the vendor.

Successful exploitation can cause denial of service by exhausting server resources during static resource resolution, leading to application unavailability. There is no impact on confidentiality or integrity reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting exposure of affected Spring Framework versions and applying any recommended configuration changes from the vendor. Avoid deploying vulnerable versions in high-risk environments where DoS impact would be critical.