Vulnerability GHSA-mq64-j8f9-9gcj
Medium Risk
MEDIUM RISK
CVSS Score: 5.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 months ago
June 09, 2026 at 06:31 AM UTC
Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40, >=6.1.0 <6.1.22, >=6.2.0 <6.2.19, >=7.0.0 <7.0.8
Summary
Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux
Details
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
Spring Framework Cross-site Scripting via JSP Form Tags
1.0.0 - 1.0.1 GHSA-957g-f97v-vppc
1.0.0 - 1.0.1 GHSA-957g-f97v-vppc
Medium Risk
3 months ago
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
Medium Risk
3 months ago
Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
1.0.0 - 1.0.1 GHSA-cjpg-rgq5-fr37
Medium Risk
3 months ago
Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40 GHSA-vqgp-pf68-6947
==5.0.0.RELEASE, ==5.0.1.RELEASE, ==5.0.10.RELEASE, ==5.0.11.RELEASE, ==5.0.12.RELEASE, ==5.0.13.RELEASE, ==5.0.14.RELEASE, ==5.0.15.RELEASE, ==5.0.16.RELEASE, ==5.0.17.RELEASE, ==5.0.18.RELEASE, ==5.0.19.RELEASE, ==5.0.2.RELEASE, ==5.0.20.RELEASE, ==5.0.3.RELEASE, ==5.0.4.RELEASE, ==5.0.5.RELEASE, ==5.0.6.RELEASE, ==5.0.7.RELEASE, ==5.0.8.RELEASE, ==5.0.9.RELEASE, ==5.1.0.RELEASE, ==5.1.1.RELEASE, ==5.1.10.RELEASE, ==5.1.11.RELEASE, ==5.1.12.RELEASE, ==5.1.13.RELEASE, ==5.1.14.RELEASE, ==5.1.15.RELEASE, ==5.1.16.RELEASE, ==5.1.17.RELEASE, ==5.1.18.RELEASE, ==5.1.19.RELEASE, ==5.1.2.RELEASE, ==5.1.20.RELEASE, ==5.1.3.RELEASE, ==5.1.4.RELEASE, ==5.1.5.RELEASE, ==5.1.6.RELEASE, ==5.1.7.RELEASE, ==5.1.8.RELEASE, ==5.1.9.RELEASE, ==5.2.0.RELEASE, ==5.2.1.RELEASE, ==5.2.10.RELEASE, ==5.2.11.RELEASE, ==5.2.12.RELEASE, ==5.2.13.RELEASE, ==5.2.14.RELEASE, ==5.2.15.RELEASE, ==5.2.16.RELEASE, ==5.2.17.RELEASE, ==5.2.18.RELEASE, ==5.2.19.RELEASE, ==5.2.2.RELEASE, ==5.2.20.RELEASE, ==5.2.21.RELEASE, ==5.2.22.RELEASE, ==5.2.23.RELEASE, ==5.2.24.RELEASE, ==5.2.25.RELEASE, ==5.2.3.RELEASE, ==5.2.4.RELEASE, ==5.2.5.RELEASE, ==5.2.6.RELEASE, ==5.2.7.RELEASE, ==5.2.8.RELEASE, ==5.2.9.RELEASE, >=5.3.0 <5.3.40 GHSA-vqgp-pf68-6947
High Risk
3 months ago
Spring Framework Cross-site Scripting via JavaScriptUtils
1.0.0 - 1.0.1 GHSA-3chg-m5w7-qfv5
1.0.0 - 1.0.1 GHSA-3chg-m5w7-qfv5
Impacted packages
Timeline
Published
3 months ago
June 09, 2026 at 06:31 AM UTC
Fixed (7.0.8)
Unknown
Unknown
Fixed (6.2.19)
Unknown
Unknown
Fixed (7.0.8)
Unknown
Unknown
Fixed (6.2.19)
Unknown
Unknown
Last Modified
18 days ago
September 10, 2026 at 03:51 AM UTC