Spring Framework DoS with Multipart Temp Files in WebFlux

Description

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsupported versions are also affected.

Scores

EPSS (exploitation in 30 days)

0.34% · top 72% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• CWE-400 Uncontrolled Resource Consumption (opens in a new tab)All about CWE-400 and its CVEs

Affected products

• VMware · Spring Framework

  • affected 7.0.0 – < 7.0.7
  • affected 6.2.0 – < 6.2.18
  • affected 6.1.0 – < 6.1.27
  • affected 5.3.0 – < 5.3.48

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.springframework:spring-webfluxGHSA-5843-p793-ghmm (opens in a new tab)

References (2)

• https://spring.io/security/cve-2026-22740 (opens in a new tab)
• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H&version=3.1 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-5843-p793-ghmm (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-22740](https://trackcve.app/badge/CVE-2026-22740.svg)](https://trackcve.app/cve/CVE-2026-22740)

Record last updated 29 Apr 2026, 14:00 UTC.