Spring Framework CVE-2026-47885

Exploitation requires two specific conditions both to be true: (1) the Spring WebFlux application must be configured with maxInMemorySize set to -1 on the PartEventHttpMessageReader or the reactive codec configuration - this is a non-default but operationally common tuning choice made to avoid buffering large uploads in heap memory; and (2) the application must expose an HTTP endpoint that accepts multipart/form-data request bodies (e.g., file upload, form submission with file attachment). Exploitation is NOT possible against Spring MVC (servlet-based) applications, applications where maxInMemorySize is set to any finite value, or endpoints that do not process multipart content types. The limiting factor for mass exploitation is that maxInMemorySize=-1 is a deliberate configuration choice rather than a default, narrowing the exploitable population to operators who specifically tuned this setting.

The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) presents a notable internal inconsistency worth flagging: the I:H (High Integrity) rating is atypical for a resource-limit bypass (CWE-770) and conflicts with the 'Information Disclosure' tag which implies confidentiality concern, yet C:N is set. A more defensible scoring for this class of vulnerability would reflect availability impact (A:H) from disk exhaustion or memory pressure, not integrity. This discrepancy should be verified with the vendor advisory at https://spring.io/security/cve-2026-47885. SSVC classifies exploitation as 'none' (consistent with EPSS of 0.15%), but flags it as 'Automatable: yes' - meaning a scanner or bot can reliably trigger the condition across many targets without manual effort. KEV status is absent, and no POC has been identified. Real-world risk is elevated in environments that expose multipart upload endpoints publicly and have intentionally set maxInMemorySize=-1 as a tuning decision; those operators may not realize it silently disables maxPartSize enforcement. The 'Technical Impact: partial' SSVC rating aligns with a limited-scope DOS or policy bypass rather than full compromise.

An attacker identifies a publicly reachable Spring WebFlux endpoint that accepts multipart/form-data requests (e.g., a file upload API). The operator has set maxInMemorySize=-1 for streaming performance and configured maxPartSize=10MB, believing the size cap is active. The attacker sends a crafted HTTP POST with a multipart body exceeding the maxPartSize limit; because the enforcement gate is skipped when maxInMemorySize=-1, the server accepts and processes the oversized part, potentially filling disk storage or exhausting downstream resources. No authentication or special tooling is required beyond a standard HTTP client.