Medium severity · published Apr 29, 2026
CVE-2026-22740
Spring Framework DoS with Multipart Temp Files in WebFlux
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.
Older, unsupported versions are also affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Spring Framework · VMware
7.0.0 before 7.0.7; 6.2.0 before 6.2.18; 6.1.0 before 6.1.27; 5.3.0 before 5.3.48 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22740
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22740
US Government Resource
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H&version=3.1
Vendor Advisory
https://spring.io/security/cve-2026-22740
More from Spring Framework
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2026-59313
Server Sent Event stream corruption in Spring MVC functional web framework
9.8
CVE-2026-47892
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
9.8
CVE-2026-47891
Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
9.8
CVE-2026-47890
Spring Framework Server Sent Event stream corruption while rendering fragments