What’s Vulnerable › Vulnerabilities

CVE-2026-22740: Spring Framework DoS with Multipart Temp Files in WebFlux

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-29 · updated 2026-10-26
• Weakness: CWE-400

Description

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsupported versions are also affected.

Affected products

• Spring Framework: before 5.3.48; from 6.1.0 before 6.1.27; from 6.2.0 before 6.2.18; from 7.0.0 before 7.0.7 — fixed in 5.3.48, 6.1.27, 6.2.18, 7.0.7
• Spring Framework: from 7.0.0 before 7.0.7; from 6.2.0 before 6.2.18; from 6.1.0 before 6.1.27; from 5.3.0 before 5.3.48 — fixed in 7.0.7, 6.2.18, 6.1.27, 5.3.48

How to fix

Upgrade to a fixed version: Spring Framework 5.3.48, 6.1.27, 6.2.18, 7.0.7; Spring Framework 7.0.7, 6.2.18, 6.1.27, 5.3.48. Check the vendor advisory for mitigations.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H&version=3.1
• https://spring.io/security/cve-2026-22740

Get alerted when CVE-2026-22740 or the next vulnerability affects your stack