Loading vulnerability…
Spring WebFlux Multipart Request Memory Leak Denial of Service
CVE-2026-41840 is a memory-leak vulnerability in Spring Framework WebFlux multipart request processing. An attacker can submit crafted multipart requests to an application endpoint that accepts multipart data, causing memory leakage and potentially exhausting application resources. Affected Spring Framework versions include 7.0.0–7.0.7, 6.2.0–6.2.18, 6.1.0–6.1.27, and 5.3.0–5.3.48; unsupported versions are also affected. The vulnerability permits network-based denial of service without requiring privileges or user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Malicious multipart requests can cause memory leakage and resource exhaustion, degrading application responsiveness or rendering the affected WebFlux application unavailable. The vulnerability has high availability impact, with no identified confidentiality or integrity impact. Its CVSS v3.1 base score is 5.9, with high attack complexity.
If you can’t patch tonight, do this now.
No separate vendor workaround is specified. Upgrading to a fixed release addresses the vulnerability, and no additional mitigation steps are required after upgrading.
Patch, then assume compromise.
Upgrade Spring Framework and its spring-webflux dependency to the corresponding fixed release: 7.0.8 or later in the 7.0.x branch, or 6.2.19 or later in the 6.2.x branch. Commercial fixes are available as 7.0.7.1, 6.2.18.1, 6.1.28, and 5.3.49. Migrate unsupported deployments to a supported, fixed release. For products bundling Spring Framework, apply the applicable vendor security update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.