Acceptance of Extraneous Untrusted Data With Trusted Data in Spring Framework - CVE-2026-22741

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU126709

Acceptance of Extraneous Untrusted Data With Trusted Data in Spring Framework - CVE-2026-22741

Published: April 21, 2026


Vulnerability identifier: #VU126709
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-22741
CWE-ID: CWE-349
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper cache control in static resource resolution when handling malicious requests for encoded resources. A remote attacker can send malicious requests to cause a denial of service.

Exploitation requires resource chain support with caching enabled, encoded resource resolution enabled, and an empty resource cache.


Affected software

Spring Framework
Db2 Developer Extension
Maximo Application Suite Ai Service
MongoDB Enterprise Advanced with IBM
IBM Sterling B2B Integrator
IBM Sterling Connect:Direct Web Services
IBM Sterling File Gateway
Library Support for Spring

How to mitigate CVE-2026-22741

Install security update from vendor's website.

Spring Framework - addressed in versions 5.3.48, 6.1.27, 6.2.18, 7.0.7
Db2 Developer Extension - update to 1.1.2
IBM Sterling B2B Integrator - addressed in versions 6.2.1.2.1, 6.2.2.1.1
IBM Sterling File Gateway - addressed in versions 6.2.1.2.1, 6.2.2.1.1
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.19, 6.4.0.8
Maximo Application Suite Ai Service - update to 9.1.15
MongoDB Enterprise Advanced with IBM - update to 1.16.0
Library Support for Spring - update to 2.7.38

External References

Related Security Bulletins