CVE-2026-41841

Medium

Advisory

Published 9 Jun 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.003; 27th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 322; of 17,781 indexed, latest versions
Container images: 281; deployed by those charts
Fix available: 2 of 2; affected packages

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

Carried by container images the latest versions of 322 of 17,781 indexed charts deploy, on 281 images.

Affected package	Affected versions	Fixed in	Images
spring-webmvcmaven	2.5.6.SEC03, 3.2.18.RELEASE, 4.3.1.RELEASE, 4.3.2.RELEASE+87 more	6.2.19, 7.0.8	254
spring-webfluxmaven	5.2.2.RELEASE, 5.2.7.RELEASE, 5.2.8.RELEASE, 5.3.1+28 more	6.2.19, 7.0.8	70

OSV records: GHSA-mq64-j8f9-9gcj

Charts affected

322 by stars

Chart

Latest

Affected images

Radar Score

polyglotncsa

0.1.1

1 of 18 See more

polyglot ncsa 0.1.1

1 of the 18 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
craigwillis/c2metadata-bd :latest	ae317d7e4724	spring-webmvc@4.3.3.RELEASE	no fix listed

Open the chart page →

55,726

config-server-helm-chartnotesprojectchart

0.1.0

1 of 1 See more

config-server-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
vlebediantsev/config-server-another :latest	e7f20450d2ae	spring-webmvc@5.3.22	no fix listed

Open the chart page →

3,422

file-system-ms-helm-chartnotesprojectchart

0.1.0

1 of 2 See more

file-system-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
vlebediantsev/file-system-ms-final :latest	10393a89b4a8	spring-webmvc@5.3.21	no fix listed

Open the chart page →

5,875

logic-ms-helm-chartnotesprojectchart

0.1.0

1 of 2 See more

logic-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
vlebediantsev/logic-ms :latest	df8bf38c535b	spring-webflux@5.3.21 spring-webmvc@5.3.21	no fix listed no fix listed

Open the chart page →

6,852

registration-ms-helm-chartnotesprojectchart

0.1.0

1 of 2 See more

registration-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
vlebediantsev/registration-ms-final :latest	427af418b75e	spring-webmvc@5.3.21	no fix listed

Open the chart page →

5,916

user-data-ms-helm-chartnotesprojectchart

0.1.0

1 of 2 See more

user-data-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
vlebediantsev/user-data-ms-final-final :latest	9319437f3c8f	spring-webmvc@5.3.21	no fix listed

Open the chart page →

5,873

cdn-remoteopencord

0.2.4

1 of 3 See more

cdn-remote opencord 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
omecproject/cdn-antmedia :1.0.0	b4ae7d0d6b74	spring-webmvc@4.3.6.RELEASE	no fix listed

Open the chart page →

63,223

ves-agentopencord

1.0.2

1 of 1 See more

ves-agent opencord 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
opencord/ves-agent :1.0.0	4187e2a8c918	spring-webmvc@5.0.6.RELEASE	no fix listed

Open the chart page →

6,350

bpjstk-serviceopenshift

1.0.0

5 of 6 See more

bpjstk-service openshift 1.0.0

5 of the 6 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
andrianrf/backoffice-be :latest	6036614803d4	spring-webmvc@5.3.27	no fix listed
andrianrf/bpjstk-service :latest	46abe878d9d8	spring-webmvc@5.2.9.RELEASE	no fix listed
andrianrf/bpjstk-simulator :latest	b63fdb51d39d	spring-webmvc@5.2.9.RELEASE	no fix listed
andrianrf/iso-client :latest	ba560086ce15	spring-webmvc@5.2.9.RELEASE	no fix listed
andrianrf/iso-server :latest	7da47f525c7d	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

34,671

fineractopenshift

0.1.1

1 of 4 See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
apache/fineract :1.12.1	a83cf1980609	spring-webmvc@6.2.5	6.2.19

Open the chart page →

7,792

redhat-springboot-restopenshift

0.0.1

1 of 1 See more

redhat-springboot-rest openshift 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
quay.io/snowdrop/spring-boot-rest-http-example :2.7	b1a054613715	spring-webmvc@5.3.31	no fix listed

Open the chart page →

3,063

smsf-configurationopenshift

1.0.4

1 of 1 See more

smsf-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
gurolakman/smsf-configuration :1.0.4	9abb3882bcbd	spring-webmvc@5.3.18	no fix listed

Open the chart page →

13,607

smsf-dispatcheropenshift

1.0.4

1 of 1 See more

smsf-dispatcher openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
gurolakman/smsf-dispatcher :1.0.4	6537e8ed8de8	spring-webflux@5.3.18	no fix listed

Open the chart page →

11,738

smsf-momtopenshift

1.0.4

1 of 1 See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
gurolakman/smsf-momt :1.0.4	ce23b20a8a17	spring-webmvc@5.3.18	no fix listed

Open the chart page →

13,568

smsf-registrationopenshift

1.0.4

1 of 1 See more

smsf-registration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
gurolakman/smsf-registration :1.0.4	b22e746edd5d	spring-webmvc@5.3.18	no fix listed

Open the chart page →

13,551

ussigw-configurationopenshift

1.0.4

1 of 1 See more

ussigw-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
gurolakman/ussigw-configuration :1.0.4	bf18525c5ad9	spring-webmvc@5.3.18	no fix listed

Open the chart page →

13,455

ussigw-coreopenshift

1.0.4

1 of 1 See more

ussigw-core openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
gurolakman/ussigw-core :1.0.4	8739565c3ea2	spring-webmvc@5.3.18	no fix listed

Open the chart page →

13,100

operatonoperaton

1.0.5

1 of 1 See more

operaton operaton 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
operaton/operaton :1.0.0-beta-4	b35867ffe4d8	spring-webmvc@6.2.5	6.2.19

Open the chart page →

2,003

issuegenopsmx

1.0.2

1 of 1 See more

issuegen opsmx 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
opsmx11/issuegen :v2.1.0	5c50ca123d88	spring-webmvc@5.1.10.RELEASE	no fix listed

Open the chart page →

26,339

pagespages

1.0.0

1 of 3 See more

pages pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-1

0.1.0

1 of 1 See more

pages pages-1 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :1.0	4d2eb25b9225	spring-webmvc@5.3.4	no fix listed

Open the chart page →

10,392

pagespages10

1.0.0

1 of 3 See more

pages pages10 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages111

1.0.0

1 of 3 See more

pages pages111 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages2

1.0.0

1 of 3 See more

pages pages2 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-alexchmielu

1.0.0

1 of 3 See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-alps

1.0.0

1 of 3 See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-alstom

1.0.0

1 of 3 See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-ambala

1.0.0

1 of 3 See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-andromeda

1.0.0

1 of 3 See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespagesbadami

1.0.0

1 of 3 See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-blackburn

1.0.0

1 of 3 See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-botes

1.0.0

1 of 3 See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-brian

1.0.0

1 of 3 See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-buckll

1.0.0

1 of 3 See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-camden

1.0.0

1 of 3 See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-camden771

1.0.0

1 of 3 See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-draco

1.0.0

1 of 3 See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-ellora

1.0.0

1 of 3 See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-finchley

1.0.0

1 of 3 See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-fornax

1.0.0

1 of 3 See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-harsh

1.0.0

1 of 3 See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespagesk

1.0.0

1 of 3 See more

pages pagesk 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-mihai

1.0.0

1 of 3 See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-nivesh

1.0.0

1 of 3 See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespagessandeepgudu

1.0.0

1 of 3 See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-shubhanker

1.0.0

1 of 3 See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-ssharma0909

1.0.0

1 of 3 See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

pagespages-sucharitha

1.0.0

1 of 3 See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-41841.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	spring-webmvc@5.2.7.RELEASE	no fix listed

Open the chart page →

20,190

Container images carrying it

281 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/gla-rad/enav-ckeeper :latest	415323ef112b	spring-webflux@7.0.6 spring-webmvc@7.0.6	7.0.8 7.0.8	1
ghcr.io/gla-rad/enav-eureka :latest	05002092c621	spring-webflux@7.0.6 spring-webmvc@7.0.6	7.0.8 7.0.8	1
ghcr.io/gla-rad/enav-msg-broker :latest	6fe372e4e481	spring-webflux@7.0.6 spring-webmvc@7.0.6	7.0.8 7.0.8	1
ghcr.io/gla-rad/enav-vdes-controller :latest	c4c52955814f	spring-webmvc@7.0.6	7.0.8	1
ghcr.io/gregperlinli/certvault :2.12.0	a7d0cc9e260a	spring-webmvc@6.2.14	6.2.19	1
ghcr.io/it-at-m/appswitcher-server :1.3.0	10006bc0f309	spring-webmvc@6.2.6	6.2.19	1
ghcr.io/it-at-m/kf-app-eai :1.0.6	5de339b3d537	spring-webmvc@6.2.10	6.2.19	1
ghcr.io/it-at-m/zammad-ldap-sync :dev	10de22c8cbce	spring-webmvc@6.2.1	6.2.19	1
ghcr.io/jfwenisch/ipfix-generator :latest	a1b05567dbf6	spring-webmvc@6.2.18	6.2.19	1
ghcr.io/jfwenisch/steamcmd-manager :v0.4.5	dab685e668d9	spring-webmvc@6.2.0	6.2.19	1
ghcr.io/jfwenisch/webtools :v0.1.4	4569cae83c70	spring-webmvc@6.2.0	6.2.19	1
ghcr.io/k8s-at-home/nzbhydra2 :v3.14.2	ef3670f7e0a8	spring-webmvc@5.2.7.RELEASE	no fix listed	1
ghcr.io/kafbat/kafka-ui :v1.2.0	185da4ad3e88	spring-webflux@6.2.3	6.2.19	1
ghcr.io/linuxserver/booksonic-air :version-v2009.1.0	baa4fa9549dc	spring-webmvc@5.2.6.RELEASE	no fix listed	1
ghcr.io/perceptolab/devops-demo-app :0.0.2	cdc0658c40fb	spring-webmvc@5.3.23	no fix listed	1
ghcr.io/privacyengineering/hawk-service :latest	bfedf47bb5e0	spring-webflux@6.1.1	no fix listed	1
ghcr.io/radar-base/managementportal/management-portal :3.0.0	c1b37e821f72	spring-webmvc@5.3.31	no fix listed	1
ghcr.io/stacksimplify/kube-usermgmt-webapp :1.0.0-mysqldb	41b45003c6b6	spring-webmvc@5.1.8.RELEASE	no fix listed	1
ghcr.io/star-whale/server :0.6.15	8368359c8dd0	spring-webflux@5.3.24 spring-webmvc@5.3.24	no fix listed no fix listed	1
ghcr.io/stirling-tools/stirling-pdf :2.14.3	3b3670fce70b	spring-webmvc@7.0.7	7.0.8	1
ghcr.io/streamvisor/streamvisor :4.1.4	0bc598b2ac9a	spring-webmvc@6.2.18	6.2.19	1
public.ecr.aws/aws-containers/retail-store-sample-cart :1.3.0	5d767569c976	spring-webmvc@6.2.10	6.2.19	1
public.ecr.aws/aws-containers/retail-store-sample-orders :1.3.0	e85f034bcf48	spring-webmvc@6.2.10	6.2.19	1
public.ecr.aws/aws-containers/retail-store-sample-ui :1.3.0	ce3f2e935eb3	spring-webflux@6.2.10	6.2.19	1
quay.io/evryfs/spring-boot-admin :2.7.10	60950ef63764	spring-webflux@5.3.24	no fix listed	1
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	spring-webmvc@6.1.1	no fix listed	1
quay.io/opsmxpublic/ubi8-oes-audit-client :isd-spin-2025.10.01-cb1bfce-202511261037	32a5b1887eab	spring-webmvc@6.1.3	no fix listed	1
quay.io/opsmxpublic/ubi8-oes-autopilot :isd-spin-2025.10.01-af26a30d4-202511261054	58bd0bcf72f9	spring-webmvc@6.1.3	no fix listed	1
quay.io/opsmxpublic/ubi8-oes-platform :isd-spin-2025.10.01-a7c191ec-202511261122	8ed603ab7417	spring-webmvc@6.1.3	no fix listed	1
quay.io/snowdrop/spring-boot-rest-http-example :2.7	b1a054613715	spring-webmvc@5.3.31	no fix listed	1
quay.io/srcmaxim/gradle-example-app :1.1.3	7c3fc28746ef	spring-webmvc@5.3.7	no fix listed	1