CVE-2026-41840: VMware Spring Framework DoS in WebFlux multipart processing

CVE-2026-41840 · Severity: medium · CVSS 5.9 · Published 2026-06-09

Spring WebFlux, a framework used to build high-performance web applications, is vulnerable to a denial-of-service attack. An attacker can send specially crafted multipart requests (typically used for file uploads) that cause the server to consume excessive resources or fail to release memory. This can lead to application slowdowns or complete service outages, preventing legitimate users from accessing the system.

Technologies: org.springframework:spring-webflux (Maven), VMware Spring Framework. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41840 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41840 being exploited in the wild.
How severe is CVE-2026-41840?
Medium severity, with a CVSS score of 5.9, published 9 June 2026.
Which products and versions are affected?
org.springframework:spring-webflux (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48.
Is there a fix for CVE-2026-41840?
Yes. org.springframework:spring-webflux (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41840 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41840?
Check whether you run org.springframework:spring-webflux (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework:spring-webflux (Maven): upgrade to 7.0.8 or later
    # set org.springframework:spring-webflux to 7.0.8 in your pom.xml or build.gradle

Technical details

Spring WebFlux contains a vulnerability classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-401 (Missing Release of Memory after Effective Lifetime). The issue occurs during the processing of multipart requests, where the framework fails to properly manage or release resources, potentially leading to memory exhaustion. The attack is network-reachable and requires no authentication, though it is rated with high attack complexity. Exploitation allows a remote attacker to trigger a Denial of Service (DoS) condition. Patches are available in versions 7.0.8 and 6.2.19, with corresponding updates for other supported branches.

Affected products

  • VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48

Identifiers

  • CVE-2026-41840
  • GHSA-83f7-v6px-pp3h

Timeline

  • 2026-06-09: advisory: Initial disclosure and publication of CVE-2026-41840
  • 2026-06-09: patched: Patched versions 7.0.8 and 6.2.19 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.