Spring MVC and Spring WebFlux applications are vulnerable to cache poisoning when resolving static resources. The flaw allows an attacker to send crafted requests that inject incorrectly encoded resources into the resource cache under the conditions that the application is using Spring MVC or WebFlux, has caching enabled, adds support for encoded resources, and the cache is initially empty when the attacker has access. This poisoned cache can subsequently break the front‑end of the application for all clients, resulting in a denial of service.

The vulnerability impacts VMware's Spring Framework, specifically applications built with Spring MVC or Spring WebFlux. No specific product version details are listed, so all deployments using the affected framework components that meet the described conditions are potentially affected.

The CVSS score is 3.1, and the EPSS score of < 1% indicates a low probability that this vulnerability will be exploited. The flaw is not listed in the CISA KEV catalog. Based on the description, the likelihood of exploitation is low, as it requires the attacker to have network access and the resource cache to be empty. If an attacker meets these conditions, they can send crafted static resource requests to poison the cache, causing a denial of service by breaking the front‑end for clients. No publicly available exploits have been reported, and the conditions for attack are clear but uncommon.