CVE-2026-22741
LowAdvisory
Published 29 Apr 2026In the index since 5 Sept 2026
- Severity
- Low
- worst across findings
- CVSS
- 3.1
- base score, highest
- EPSS
- 0.002
- 15th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 312
- of 17,781 indexed, latest versions
- Container images
- 269
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.
Carried by container images the latest versions of 312 of 17,781 indexed charts deploy, on 269 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| spring-webmvcmaven | 2.5.6.SEC03, 3.2.18.RELEASE, 4.3.1.RELEASE, 4.3.2.RELEASE+85 more | 6.2.18, 7.0.7 | 242 |
| spring-webfluxmaven | 5.2.2.RELEASE, 5.2.7.RELEASE, 5.2.8.RELEASE, 5.3.1+27 more | 6.2.18, 7.0.7 | 67 |
- OSV records
- GHSA-wg35-8jpf-2xv3
Charts affected
312 by stars
Container images carrying it
269 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| just1not2/ | 8a2305192dec | spring-webmvc | no fix listed | 1 |
| kimb88/ | 0639155241cb | spring-webmvc | no fix listed | 1 |
| krontechnology/ | 7feef7d2ab42 | spring-webmvc | no fix listed | 1 |
| kubebb/ | 4d062f20309c | spring-webmvc | no fix listed | 1 |
| kvalitetsit/ | f0af0ba589af | spring-webmvc | no fix listed | 1 |
| ladeit/ | 962b665ffe82 | spring-webmvc | no fix listed | 1 |
| lavandadelpatio/ | 94e225a5a6f8 | spring-webmvc | no fix listed | 1 |
| lavandadelpatio/ | 92de3c3426d2 | spring-webmvc | no fix listed | 1 |
| lavandadelpatio/ | 71f2ccec8c0d | spring-webmvc | no fix listed | 1 |
| lavandadelpatio/ | d2cba20aa4d8 | spring-webmvc | no fix listed | 1 |
| lavandadelpatio/ | f36af885e915 | spring-webmvc | no fix listed | 1 |
| linuxserver/ | d286a7f55a59 | spring-webmvc | no fix listed | 1 |
| linuxserver/ | 0ae315a3a456 | spring-webmvc | no fix listed | 1 |
| linuxserver/ | ab105cc50322 | spring-webmvc | no fix listed | 1 |
| microcks/ | e3a3e0c67b09 | spring-webmvc | no fix listed | 1 |
| nacos/ | 0e951a1d07bb | spring-webmvc | 6.2.18 | 1 |
| nacos/ | 30a39cb0c54d | spring-webmvc | 6.2.18 | 1 |
| nacos/ | fe6e5688cdf3 | spring-webmvc | no fix listed | 1 |
| omecproject/ | b4ae7d0d6b74 | spring-webmvc | no fix listed | 1 |
| openbas/ | d986d80b0a75 | spring-webflux spring-webmvc | no fix listed no fix listed | 1 |
| opencord/ | 4187e2a8c918 | spring-webmvc | no fix listed | 1 |
| openkm/ | 3bc465a7461b | spring-webmvc | no fix listed | 1 |
| operaton/ | b35867ffe4d8 | spring-webmvc | 6.2.18 | 1 |
| opsmx11/ | 5c50ca123d88 | spring-webmvc | no fix listed | 1 |
| paulczar/ | c7140cecd5f7 | spring-webmvc | no fix listed | 1 |
| platform9community/ | de3fa9b70df1 | spring-webflux | no fix listed | 1 |
| platform9community/ | 40a4970de568 | spring-webflux | no fix listed | 1 |
| platform9community/ | 2089811e5cc6 | spring-webmvc | no fix listed | 1 |
| platform9community/ | d1165c94dfb3 | spring-webmvc | no fix listed | 1 |
| platform9community/ | 8d11b50368c6 | spring-webmvc | no fix listed | 1 |
| polyakov/ | dbcef69146b8 | spring-webmvc | no fix listed | 1 |
| rabeh/ | 941007b6946e | spring-webmvc | no fix listed | 1 |
| razzy10/ | 702e411956db | spring-webmvc | 6.2.18 | 1 |
| redestroyder/ | 740364a619fd | spring-webflux | no fix listed | 1 |
| redestroyder/ | db03499a0726 | spring-webflux | no fix listed | 1 |
| refar/ | 241373fa2972 | spring-webmvc | no fix listed | 1 |
| refar/ | e5490f050f9f | spring-webmvc | no fix listed | 1 |
| remche/ | 8bcda8a04d3b | spring-webmvc | no fix listed | 1 |
| reportportal/ | 9df41f8fb320 | spring-webmvc | no fix listed | 1 |
| reportportal/ | 9e73114dbd15 | spring-webmvc | no fix listed | 1 |
| reportportal/ | dc166c58485a | spring-webmvc | no fix listed | 1 |
| richardchesterwood/ | 518f946b9f05 | spring-webmvc | no fix listed | 1 |
| richardchesterwood/ | 36c43961214c | spring-webmvc | no fix listed | 1 |
| richardchesterwood/ | f7f8d5951155 | spring-webmvc | no fix listed | 1 |
| rm3l/ | 9a7f732245a3 | spring-webflux spring-webmvc | no fix listed no fix listed | 1 |
| rm3l/ | 62d1cc4223e5 | spring-webflux spring-webmvc | no fix listed no fix listed | 1 |
| robotshop/ | 89753ab48919 | spring-webmvc | no fix listed | 1 |
| royalwang/ | df99e2499f91 | spring-webmvc | no fix listed | 1 |
| rundeck/ | 4d64fe56f767 | spring-webmvc | no fix listed | 1 |
| rundeck/ | b13e8059ad72 | spring-webmvc | no fix listed | 1 |