CLEANSTART-2026-YF86860: PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1

Q: Under what configuration is the size limit bypassed?

The bypass occurs when Spring WebFlux PartEventHttpMessageReader is configured with maxInMemorySize set to -1. In that configuration, maxPartSize is not enforced.

Q: Can this be exploited remotely without credentials or user interaction?

Yes. The supplied severity vector indicates network attack access with low complexity, no required privileges, and no user interaction.

Q: What is the likely security impact?

The supplied vector indicates an integrity impact rated High, with no indicated confidentiality or availability impact.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-47885

Frequently Asked Questions

Under what configuration is the size limit bypassed?

The bypass occurs when Spring WebFlux PartEventHttpMessageReader is configured with maxInMemorySize set to -1. In that configuration, maxPartSize is not enforced.

Can this be exploited remotely without credentials or user interaction?

Yes. The supplied severity vector indicates network attack access with low complexity, no required privileges, and no user interaction.

What is the likely security impact?

The supplied vector indicates an integrity impact rated High, with no indicated confidentiality or availability impact.

CLEANSTART-2026-YF86860: PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Under what configuration is the size limit bypassed?

Can this be exploited remotely without credentials or user interaction?

What is the likely security impact?

Company

Resources

Contact

Frequently Asked Questions

Under what configuration is the size limit bypassed?

Can this be exploited remotely without credentials or user interaction?

What is the likely security impact?