What is the CVSS score of CVE-2026-41840?

CVE-2026-41840 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41840?

Yes, a patch is available for CVE-2026-41840. Update the affected software to the latest version immediately.

Spring Framework CVE-2026-41840

EUVD-2026-35327 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-06-09 vmware

GHSA-83f7-v6px-pp3h

Denial Of Service Java Spring Framework

5.9

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:25 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.springframework:spring-webflux (5 direct, 1 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

AnalysisAI

Denial of Service in Spring WebFlux's multipart request processing allows unauthenticated remote attackers to exhaust server resources across all supported Spring Framework branches. Affects Spring Framework 5.3.x through 7.0.x when applications use the reactive WebFlux stack and expose endpoints that accept multipart data. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the network-reachable, zero-privilege attack surface warrants prompt patching for internet-facing WebFlux deployments.

Technical ContextAI

Spring WebFlux is the reactive, non-blocking web framework introduced in Spring Framework 5.0, built on Project Reactor and Netty. Unlike the traditional Spring MVC servlet stack, WebFlux uses event-loop concurrency, making uncontrolled resource consumption (CWE-400) especially impactful: a thread pool starved of resources or a heap exhausted by unbounded buffering can collapse the entire reactive pipeline rather than just a single request thread. The CPE identifier cpe:2.3:a:spring:spring_framework:* covers all affected major lines (5.3, 6.1, 6.2, 7.0). CWE-400 indicates the root cause is failure to impose appropriate limits - likely on the size, count, or parsing depth of multipart form parts - allowing a crafted request to trigger unbounded memory or CPU consumption during part assembly or header parsing.

RemediationAI

Upgrade to a patched Spring Framework release per the VMware/Spring vendor advisory at https://spring.io/security/cve-2026-41840. The advisory should specify the exact fixed versions for each branch (5.3.x, 6.1.x, 6.2.x, 7.0.x); however, exact fixed version numbers were not included in the available input data, so refer directly to the Spring security page to confirm the minimum safe version for your branch before upgrading. If an immediate upgrade is not possible, consider the following compensating controls with their trade-offs: restrict multipart request body size at the reverse proxy or load balancer layer (e.g., nginx client_max_body_size or AWS ALB content-length limits) to limit the payload an attacker can supply - note this may reject legitimate large file uploads; require authentication before any multipart endpoint is reachable, which raises the bar for exploitation given AC:H is already elevated; or temporarily disable multipart endpoints if they are non-essential to the application. Each control reduces attack surface but does not eliminate the underlying vulnerability.