CVE-2026-22740CWE-400

Spring Framework DoS with Multipart Temp Files in WebFlux

Medium · published April 29, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.

Older, unsupported versions are also affected.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00344 · 26.7th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-04-29T10:46Z
EPSS history
Timeline
  • 29 APR 10:46Z
    Spring Framework DoS with Multipart Temp Files in WebFlux
    cvelistv5