EUVD-2026-26205Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable multipart endpoint requires authenticated session (PR:L); disk exhaustion achieves high availability impact with no confidentiality or integrity effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6Blast Radius
ecosystem impact- 6 maven packages depend on org.springframework:spring-webflux (5 direct, 1 indirect)
Ecosystem-wide dependent count for version 7.0.0.
DescriptionCVE.org
A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.
Older, unsupported versions are also affected.
AnalysisAI
Disk exhaustion via undeleted temp files in Spring WebFlux multipart processing affects all actively maintained Spring Framework branches, allowing an authenticated remote attacker to consume available disk space on the host. Affected branches span 5.3.x, 6.1.x, 6.2.x, and 7.0.x, with fixed releases available for all. No public exploit exists and EPSS sits at the 9th percentile, but the network-accessible attack surface and potential for cascading host-level impact make this a meaningful availability risk for any Spring WebFlux deployment that handles multipart uploads.
Technical ContextAI
Spring WebFlux is the reactive, non-blocking web framework within VMware's Spring Framework (CPE: cpe:2.3:a:vmware:spring_framework). When a WebFlux server processes a multipart HTTP request, it buffers individual parts that exceed 10 KB to temporary files on disk rather than holding them in memory. The root cause (CWE-400, Uncontrolled Resource Consumption) is that under certain unspecified conditions these temporary files are not deleted after the request lifecycle completes. This is distinct from the traditional Spring MVC servlet stack; only WebFlux applications using multipart handling are exposed. The 10 KB threshold means an attacker need only craft parts marginally above that size to trigger file creation with minimal bandwidth, and repeated requests accumulate files until disk capacity is exhausted.
RemediationAI
Upgrade to the patched releases Spring Framework 6.2.18, 6.1.27, 5.3.48, or 7.0.7 as documented at https://spring.io/security/cve-2026-22740. For teams unable to patch immediately, consider restricting access to multipart endpoints to more-trusted authenticated roles via Spring Security - this narrows the population of potential attackers without requiring a code change, though it may break intended functionality if broader access is required. Alternatively, deploying a reverse proxy or WAF rule to cap the number of multipart requests per authenticated session or per time window limits the rate at which temp files can accumulate, providing meaningful protection with low application impact. Periodic cleanup of the JVM temp directory via an OS-level cron job is a last-resort backstop but does not eliminate the vulnerability and introduces a race condition risk if files are deleted while a legitimate request is in flight. For users on unsupported branches, HeroDevs provides commercial extended support guidance at https://www.herodevs.com/vulnerability-directory/cve-2026-22740.
More in Spring Framework
View allThe Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable e
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not di
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versio
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow app
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolutio
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow app
Authorization bypass in Spring Framework WebFlux functional-endpoint applications deployed on DispatcherServlet allows a
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across
Cross-response information disclosure and stream corruption affects Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8 (both
Denial of service in Spring Framework WebFlux applications (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.
Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJso
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today