Executive brief
Spring WebFlux, a framework used to build high-performance web applications, is vulnerable to a denial-of-service attack. An attacker can send specially crafted multipart requests (typically used for file uploads) that cause the server to consume excessive resources or fail to release memory. This can lead to application slowdowns or complete service outages, preventing legitimate users from accessing the system.
Technical details
Spring WebFlux contains a vulnerability classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-401 (Missing Release of Memory after Effective Lifetime). The issue occurs during the processing of multipart requests, where the framework fails to properly manage or release resources, potentially leading to memory exhaustion. The attack is network-reachable and requires no authentication, though it is rated with high attack complexity. Exploitation allows a remote attacker to trigger a Denial of Service (DoS) condition. Patches are available in versions 7.0.8 and 6.2.19, with corresponding updates for other supported branches.
Affected products
- VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48
Timeline
- 2026-06-09: advisory: Initial disclosure and publication of CVE-2026-41840
- 2026-06-09: patched: Patched versions 7.0.8 and 6.2.19 released