CVE-2026-47885: Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
Published Aug 27, 2026
·Updated
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28
Affected Software
1 affected component
Spring Spring Framework>=7.0.0<=7.0.8, >=6.2.0<=6.2.19, >=6.1.0<=6.1.28
Event History
Aug 27, 2026
CVE Published
via MITRE·05:21 AM
Data Sourced
via MITRE·05:21 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
Which deployments are affected?
Affected deployments use Spring WebFlux with PartEventHttpMessageReader and have maxInMemorySize configured as -1. The affected Spring Framework release ranges are 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, and 6.1.0 through 6.1.28.
2
What configuration condition is required for the maxPartSize limit to be bypassed?
The issue occurs when PartEventHttpMessageReader has maxInMemorySize set to -1. Under that condition, maxPartSize is not enforced.