Executive brief
Spring Framework, a widely used tool for building Java-based web applications, is affected by a vulnerability in how it handles complex web requests containing multiple parts (such as file uploads). An attacker could potentially bypass security filters or manipulate how the server interprets these requests. This could lead to unauthorized actions or data modification, though it does not directly allow for data theft or system crashes.
Technical details
Spring Framework is vulnerable to HTTP Request Smuggling (CWE-444) specifically within its Multipart request handling in Spring MVC and WebFlux. The vulnerability arises from inconsistent interpretation of multipart HTTP requests between the Spring application and intermediary proxies or the underlying server container. A remote, unauthenticated attacker can exploit this by sending specially crafted multipart requests to 'smuggle' a second request that the application processes unexpectedly. This can be used to bypass security constraints or perform unauthorized actions. Patches are available in versions 7.0.8 and 6.2.19; users on older branches should monitor for corresponding updates.
Affected products
- VMware Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-07-30: patched: Updated advisory with patch versions 7.0.8 and 6.2.19