Spring MVC or Spring WebFlux applications are vulnerable to a denial of service when they serve static resources from the file system on Windows. An attacker can craft malicious requests that resolve slowly, causing HTTP connections to remain open and exhaust server resources. The weakness is identified as CWE‑400 and CWE‑770 and does not affect confidentiality or integrity, but can render the application unresponsive.

The vulnerability affects applications built with VMware’s Spring Framework, specifically Spring MVC and Spring WebFlux. No specific affected release versions are listed in the advisory, so all deployments of these components on Windows should be evaluated for patch status.

The CVSS score of 5.3 indicates a medium severity for this DoS vector. The EPSS score of 0.00057 indicates a very low probability of exploitation and the vulnerability is not listed in CISA KEV. The likely attack vector is remote network access, and the attack is likely to succeed on any exposed instance that satisfies the three conditions of the vulnerability. If exploited, the application may serve no new requests until connections are released or the server is restarted.