CVE-2026-22740: Spring Framework DoS with Multipart Temp Files in WebFlux
A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.
Older, unsupported versions are also affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22740?
CVE-2026-22740 has a high severity rating due to its potential to cause Denial of Service (DoS) attacks.
How do I fix CVE-2026-22740?
To fix CVE-2026-22740, ensure that you are using the latest version of the Spring Framework which contains the necessary patches.
What type of applications are affected by CVE-2026-22740?
CVE-2026-22740 affects WebFlux server applications that process multipart requests.
What impact does CVE-2026-22740 have on an application?
CVE-2026-22740 allows an attacker to potentially exhaust system resources by leaving temporary files after processing multipart requests.
Is CVE-2026-22740 an environment-specific vulnerability?
CVE-2026-22740 is not environment-specific and can affect any WebFlux server application using the vulnerable versions of the Spring Framework.