CVE-2026-22741
LowAdvisory
Published 29 Apr 2026In the index since 5 Sept 2026
- Severity
- Low
- worst across findings
- CVSS
- 3.1
- base score, highest
- EPSS
- 0.002
- 15th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 312
- of 17,781 indexed, latest versions
- Container images
- 269
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.
Carried by container images the latest versions of 312 of 17,781 indexed charts deploy, on 269 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| spring-webmvcmaven | 2.5.6.SEC03, 3.2.18.RELEASE, 4.3.1.RELEASE, 4.3.2.RELEASE+85 more | 6.2.18, 7.0.7 | 242 |
| spring-webfluxmaven | 5.2.2.RELEASE, 5.2.7.RELEASE, 5.2.8.RELEASE, 5.3.1+27 more | 6.2.18, 7.0.7 | 67 |
- OSV records
- GHSA-wg35-8jpf-2xv3
Charts affected
312 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| configservertwomartensVerified publisher | 0.2.0 | 1 of 1See more | 2,144 |
| timetabletwomartensVerified publisher | 0.2.0 | 1 of 1See more | 1,527 |
| wahlrechttwomartensVerified publisher | 0.3.0 | 1 of 1See more | 1,689 |
| pagesvictor-pages | 1.0.0 | 1 of 3See more | 20,190 |
| kube-monitoring-telegram-botviento-repository | 1.0.0 | 1 of 1See more | 7,885 |
| pageswalter | 1.0.0 | 1 of 3See more | 20,190 |
| webapp-db-javawebapp-db-java-repo | 0.1.0 | 1 of 2See more | 2,566 |
| webhookiewebhookie | 0.1.2 | 1 of 1See more | 14,364 |
| webhookie-allwebhookie | 0.1.2 | 1 of 3See more | 28,605 |
| hazelcastwenerme | 5.10.2 | 1 of 2See more | 2,634 |
| workshop-pipelinesworkshop-pipelines | 0.1.6 | 1 of 2See more | 11,577 |
| zahori-serverzahoriVerified publisher | 1.0.1 | 1 of 2See more | 5,846 |
Container images carrying it
269 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| apache/ | 75d48a62748f | spring-webflux spring-webmvc | 6.2.18 6.2.18 | 1 |
| apache/ | a2bab1be574c | spring-webmvc | 6.2.18 | 1 |
| apache/ | 8647309f95d1 | spring-webmvc | no fix listed | 1 |
| apache/ | 090b7f87ec7f | spring-webmvc | no fix listed | 1 |
| apache/ | 63b8e3e40742 | spring-webmvc | no fix listed | 1 |
| apache/ | 974efa2f21da | spring-webmvc | no fix listed | 1 |
| apache/ | c8fb51195444 | spring-webmvc | no fix listed | 1 |
| apacherocketmq/ | 24799aff6cf8 | spring-webmvc | no fix listed | 1 |
| apache/ | e2be712fc4f4 | spring-webmvc | no fix listed | 1 |
| apache/ | 1bd5756f6273 | spring-webflux | no fix listed | 1 |
| apache/ | 295f1dc87d98 | spring-webflux | no fix listed | 1 |
| apache/ | 67d50e4deff4 | spring-webmvc | no fix listed | 1 |
| apache/ | 80530f0308a5 | spring-webflux | no fix listed | 1 |
| apimap/ | ae2b3ab00177 | spring-webflux | no fix listed | 1 |
| aroralalit/ | 2a094f597b36 | spring-webmvc | no fix listed | 1 |
| arturisimo/ | c95524e90b57 | spring-webmvc | no fix listed | 1 |
| assistiot/ | e4414cb72dc4 | spring-webmvc | no fix listed | 1 |
| atlassian/ | 3b9222ab32ef | spring-webmvc | no fix listed | 1 |
| atlassian/ | ebf761c7d437 | spring-webmvc | no fix listed | 1 |
| audig/ | 2c3fe34ee430 | spring-webmvc | no fix listed | 1 |
| beastob/ | 99a49885ab33 | spring-webmvc | no fix listed | 1 |
| binhex/ | fb8952921ab6 | spring-webmvc | no fix listed | 1 |
| blackducksoftware/ | 90cca32de2cc | spring-webmvc | no fix listed | 1 |
| bluerange/ | 07c8f73b55df | spring-webflux spring-webmvc | 6.2.18 6.2.18 | 1 |
| camunda/ | ab5abc09e407 | spring-webflux | no fix listed | 1 |
| castlemock/ | b7f3f1527ba9 | spring-webmvc | 6.2.18 | 1 |
| cbioportal/ | 08debbd2dbf9 | spring-webmvc | 6.2.18 | 1 |
| chandanteekinavar/ | 0cf52bf5ee9a | spring-webmvc | no fix listed | 1 |
| choerodon/ | 3c94c97f6f69 | spring-webmvc | no fix listed | 1 |
| cnieg/ | d4b478d76f2a | spring-webmvc | no fix listed | 1 |
| commerceexperts/ | 9e33ad89baf6 | spring-webmvc | no fix listed | 1 |
| conductoross/ | 9fba127693e6 | spring-webflux spring-webmvc | no fix listed no fix listed | 1 |
| craigwillis/ | ae317d7e4724 | spring-webmvc | no fix listed | 1 |
| dannielkil/ | e3b479a55a69 | spring-webmvc | no fix listed | 1 |
| dellcloud/ | 02fc234353a9 | spring-webmvc | no fix listed | 1 |
| dellcloud/ | 4d2eb25b9225 | spring-webmvc | no fix listed | 1 |
| eclipseaerios/ | 43cd999a008d | spring-webmvc | no fix listed | 1 |
| eclipseaerios/ | 15fba526a4f8 | spring-webmvc | no fix listed | 1 |
| elastictranscoder/ | 963ab3858c6b | spring-webmvc | no fix listed | 1 |
| elastictranscoder/ | 26208b8c2359 | spring-webflux spring-webmvc | no fix listed no fix listed | 1 |
| elastictranscoder/ | b4a0327029e6 | spring-webmvc | no fix listed | 1 |
| elastictranscoder/ | 5b75d19e2733 | spring-webmvc | no fix listed | 1 |
| erudikaltd/ | 949c56b57e8f | spring-webmvc | 7.0.7 | 1 |
| expediagroup/ | 4f2cf61e7de9 | spring-webflux | no fix listed | 1 |
| fabioformosa/ | 063873af085c | spring-webmvc | 6.2.18 | 1 |
| fimperato/ | 6441f6545613 | spring-webmvc | no fix listed | 1 |
| fimperato/ | e32920eedd3a | spring-webmvc | no fix listed | 1 |
| fimperato/ | 604012b77841 | spring-webmvc | no fix listed | 1 |
| fimperato/ | c0cfaca070d9 | spring-webmvc | no fix listed | 1 |
| flofree/ | 6b6486c5f81e | spring-webmvc | no fix listed | 1 |