Executive brief
A vulnerability in the Spring Framework's WebFlux component can lead to a denial-of-service condition. When the application processes large file uploads, it creates temporary files that may not be properly deleted after the request is finished. An attacker could exploit this to fill up the server's disk space, potentially causing the application or the entire server to crash or stop responding.
Technical details
This is a resource consumption vulnerability (CWE-400) within the Spring WebFlux multipart request handling logic. When processing multipart data, the framework generates temporary files for parts exceeding 10 KB; however, a logic error prevents these files from being deleted upon request completion in specific scenarios. An authenticated attacker can exploit this by sending numerous large multipart requests to exhaust the host's disk space (Denial of Service). The vulnerability is reachable over the network and requires low privileges. Patches are available in versions 7.0.7 and 6.2.18, while older versions remain affected.
Affected products
- VMware Spring Framework (spring-webflux) >= 7.0.0, <= 7.0.6
- VMware Spring Framework (spring-webflux) >= 6.2.0, <= 6.2.17
- VMware Spring Framework (spring-webflux) >= 6.1.0, <= 6.1.26
- VMware Spring Framework (spring-webflux) <= 5.3.47
Timeline
- 2026-04-29: advisory: Initial publication of GHSA-5843-p793-ghmm
- 2026-04-29: disclosed
- 2026-05-06: other: GitHub advisory reviewed
References
- https://api.github.com/users/yuki-matsuhashi
- https://github.com/yuki-matsuhashi
- https://api.github.com/users/yuki-matsuhashi/gists%7B/gist_id%7D
- https://api.github.com/users/yuki-matsuhashi/repos
- https://avatars.githubusercontent.com/u/250794953?v=4
- https://api.github.com/users/yuki-matsuhashi/events%7B/privacy%7D