medium5.9
CVE-2026-41840
Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.
Impact
Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework:spring-webflux | >= 7.0.0, <= 7.0.7 | 7.0.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Framework | from 5.3.0 before 5.3.49 from 6.1.0 before 6.1.28 from 6.2.0 before 6.2.18.1 from 7.0.0 before 7.0.7.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-83f7-v6px-pp3h
- https://nvd.nist.gov/vuln/detail/CVE-2026-41840
- https://spring.io/security/cve-2026-41840
- https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19
- https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8