Executive brief
Spring WebFlux is a framework used to build reactive web applications in Java. A vulnerability in the PartEventHttpMessageReader component fails to enforce file upload size limits when misconfigured, potentially allowing attackers to upload excessively large files that could consume server memory and cause service outages.
Technical details
The vulnerability exists in Spring WebFlux's PartEventHttpMessageReader, which fails to enforce the maxPartSize limit when maxInMemorySize is set to -1. This is an input validation bypass affecting multipart file upload handling. Attackers can exploit this by sending specially crafted multipart requests to endpoints that use this reader, bypassing intended size restrictions and exhausting server resources. The issue affects Spring Framework versions 6.1.0–6.1.28, 6.2.0–6.2.19, and 7.0.0–7.0.8. Patches are available in newer versions.
Affected products
- Spring Framework 6.1.0–6.1.28, 6.2.0–6.2.19, 7.0.0–7.0.8
Timeline
- 2026-08-27: published