A flaw in Spring MVC and WebFlux causes static resources to be processed in a way that can exhaust server resources and render the application unavailable. The vulnerability is classified as CWE‑400, which pertains to excessive resource consumption. An attacker could repeatedly request static assets, forcing the framework to allocate memory or I/O buffers until the system becomes unresponsive, thereby denying legitimate users access to the application.

The affected products are versions of the Spring Framework, including Spring MVC and WebFlux. Vulnerable releases are Spring Framework 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. Any application built on these releases is at risk if it serves static resources.

The CVSS score of 7.5 indicates a high severity of this denial‑of‑service vulnerability. The EPSS score is not available, but the lack of a known exploit in CISA’s KEV catalog suggests that active exploitation is not yet documented. However, the attack vector is inferred to be remote, as an attacker can trigger the flaw by sending crafted HTTP requests to the application’s static resource endpoints. Given the potential for widespread availability impact, the risk remains significant for exposed systems.