Spring Framework Cache Poisoning Vulnerability in Static Resource Handling

A cache poisoning vulnerability has been identified in Spring MVC and Spring WebFlux applications when managing static resources. This issue arises under specific conditions: the application must be using either Spring MVC or WebFlux, have resource chain support configured with caching enabled, support encoded resource resolution, and have an empty resource cache when the attacker gains access. If these conditions are met, an attacker can send malicious requests that introduce incorrectly encoded resources into the cache, potentially disrupting the front-end application for users and causing a denial-of-service effect.

Impact

Exploitation of this vulnerability can lead to cache poisoning, causing a denial-of-service condition by disrupting the front-end application for users.

Remediation

Users should upgrade to Spring Framework versions 7.0.7, 6.2.18, 6.1.27 (commercial), or 5.3.48 (commercial), depending on their current version.