Spring MVC or Spring WebFlux applications are vulnerable to a denial of service when they serve static resources from the file system on Windows. An attacker can craft malicious requests that resolve slowly, causing HTTP connections to remain open and exhaust server resources. The weakness is identified as CWE‑400 and does not affect confidentiality or integrity, but can render the application unresponsive.

The vulnerability affects applications built with VMware’s Spring Framework, specifically Spring MVC and Spring WebFlux. No specific affected release versions are listed in the advisory, so all deployments of these components on Windows should be evaluated for patch status.

The CVSS score of 5.3 indicates a medium severity for this DoS vector. EPSS information is not available and the vulnerability is not listed in CISA KEV. The attack requires remote network access and is likely to succeed on any exposed instance that satisfies the three conditions of the vulnerability. If exploited, the application may serve no new requests until connections are released or the server is restarted.