# CVE-2026-41853: VMware Spring Framework multipart request smuggling in MVC and WebFlux

Source: https://junglewise.ai/threats/cve-2026-41853-vmware-spring-framework-multipart-request-smuggling-in-mvc-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-41853 · Severity: medium · CVSS 5.3 · Published 2026-06-09

Spring Framework, a widely used tool for building Java-based web applications, is affected by a vulnerability in how it handles complex web requests containing multiple parts (such as file uploads). An attacker could potentially bypass security filters or manipulate how the server interprets these requests. This could lead to unauthorized actions or data modification, though it does not directly allow for data theft or system crashes.

Technologies: [org.springframework:spring-webflux (Maven)](https://junglewise.ai/threats/technologies/org-springframework-spring-webflux), [org.springframework:spring-webmvc (Maven)](https://junglewise.ai/threats/technologies/org-springframework-spring-webmvc), [VMware Spring Framework](https://junglewise.ai/threats/technologies/spring-framework). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41853 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41853 being exploited in the wild.

**How severe is CVE-2026-41853?** Medium severity, with a CVSS score of 5.3, published 9 June 2026.

**Which products and versions are affected?** org.springframework:spring-webflux (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; org.springframework:spring-webmvc (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48, 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

**Is there a fix for CVE-2026-41853?** Yes. org.springframework:spring-webflux (Maven): upgrade to 7.0.8 or later; org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41853 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41853?** Check whether you run org.springframework:spring-webflux (Maven), org.springframework:spring-webmvc (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework:spring-webflux (Maven): upgrade to 7.0.8 or later

  ```sh
  # set org.springframework:spring-webflux to 7.0.8 in your pom.xml or build.gradle
  ```

- org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later

  ```sh
  # set org.springframework:spring-webmvc to 7.0.8 in your pom.xml or build.gradle
  ```


## Technical details

Spring Framework is vulnerable to HTTP Request Smuggling (CWE-444) specifically within its Multipart request handling in Spring MVC and WebFlux. The vulnerability arises from inconsistent interpretation of multipart HTTP requests between the Spring application and intermediary proxies or the underlying server container. A remote, unauthenticated attacker can exploit this by sending specially crafted multipart requests to 'smuggle' a second request that the application processes unexpectedly. This can be used to bypass security constraints or perform unauthorized actions. Patches are available in versions 7.0.8 and 6.2.19; users on older branches should monitor for corresponding updates.

## Affected products

- VMware Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48

## Identifiers

- CVE-2026-41853
- GHSA-cjpg-rgq5-fr37

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-07-30: patched: Updated advisory with patch versions 7.0.8 and 6.2.19

## References

- [https://spring.io/security/cve-2026-41853](https://spring.io/security/cve-2026-41853)
- [https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19](https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19)
- [https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8](https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8)

## Related threats

- [Spring Framework stream corruption in Server-Sent Events](https://junglewise.ai/threats/cve-2026-59313-spring-framework-stream-corruption-in-server-sent-events)
- [Spring Framework Server Sent Event stream corruption while rendering fragments](https://junglewise.ai/threats/cve-2026-47890-spring-framework-server-sent-event-stream-corruption-while)
- [Spring Framework information disclosure in WebSocket exception handling](https://junglewise.ai/threats/cve-2026-47893-spring-framework-information-disclosure-in-websocket-exception)
- [Spring Framework header predicate bypass in WebFlux functional endpoints](https://junglewise.ai/threats/cve-2026-47892-spring-framework-header-predicate-bypass-in-webflux-functional)
- [Spring Framework XML maxInMemorySize enforcement bypass](https://junglewise.ai/threats/cve-2026-47891-spring-framework-xml-maxinmemorysize-enforcement-bypass)