CVE-2026-22740: Spring Framework denial of service in WebFlux multipart handling

CVE-2026-22740 · Severity: medium · CVSS 6.5 · Published 2026-04-29

A vulnerability in the Spring Framework's WebFlux component can lead to a denial-of-service condition. When the application processes large file uploads, it creates temporary files that may not be properly deleted after the request is finished. An attacker could exploit this to fill up the server's disk space, potentially causing the application or the entire server to crash or stop responding.

Technologies: org.springframework:spring-webflux (Maven), VMware Spring Framework. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-22740 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22740 being exploited in the wild.
How severe is CVE-2026-22740?
Medium severity, with a CVSS score of 6.5, published 29 April 2026.
Which products and versions are affected?
org.springframework:spring-webflux (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.7; VMware Spring Framework >= 7.0.0, <= 7.0.6.
Is there a fix for CVE-2026-22740?
Yes. org.springframework:spring-webflux (Maven): upgrade to 7.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22740 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-22740?
Check whether you run org.springframework:spring-webflux (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework:spring-webflux (Maven): upgrade to 7.0.7 or later
    # set org.springframework:spring-webflux to 7.0.7 in your pom.xml or build.gradle

Technical details

This is a resource consumption vulnerability (CWE-400) within the Spring WebFlux multipart request handling logic. When processing multipart data, the framework generates temporary files for parts exceeding 10 KB; however, a logic error prevents these files from being deleted upon request completion in specific scenarios. An authenticated attacker can exploit this by sending numerous large multipart requests to exhaust the host's disk space (Denial of Service). The vulnerability is reachable over the network and requires low privileges. Patches are available in versions 7.0.7 and 6.2.18, while older versions remain affected.

Affected products

  • VMware Spring Framework (spring-webflux) >= 7.0.0, <= 7.0.6
  • VMware Spring Framework (spring-webflux) >= 6.2.0, <= 6.2.17
  • VMware Spring Framework (spring-webflux) >= 6.1.0, <= 6.1.26
  • VMware Spring Framework (spring-webflux) <= 5.3.47

Identifiers

  • CVE-2026-22740
  • GHSA-5843-p793-ghmm

Timeline

  • 2026-04-29: advisory: Initial publication of GHSA-5843-p793-ghmm
  • 2026-04-29: disclosed
  • 2026-05-06: other: GitHub advisory reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.