GitHub Advisoryadvisory · Maven

GHSA-5843-p793-ghmm Spring Framework DoS with Multipart Temp Files in WebFlux

MEDIUM Published 2026-04-29 Modified 2026-07-02 Official page ↗
Aliases
CVE-2026-22740
Ecosystem
Maven
Packages
org.springframework:spring-webflux
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2026-05-06

Affected packages

• Maven org.springframework:spring-webflux: >= 7.0.0, < 7.0.7 → fixed in 7.0.7 • Maven org.springframework:spring-webflux: >= 6.2.0, < 6.2.18 → fixed in 6.2.18 • Maven org.springframework:spring-webflux: >= 6.1.0, <= 6.1.26 (no fix yet) • Maven org.springframework:spring-webflux: <= 5.3.47 (no fix yet)

Description

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsupported versions are also affected.

Related

Alias · CVE (1)

  • CVE-2026-22740 A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References