CVE-2026-22740 Security Details

CVE ID

CVE-2026-22740

CWE

CWE-400

CVE Description

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsupported versions are also affected.

Published

Apr 21, 2026

CVSS Score & Severity

7.1High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.061%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/http/codec/multipart/MultipartHttpMessageReader.readMono(Lorg/springframework/core/ResolvableType;Lorg/springframework/http/ReactiveHttpInputMessage;Ljava/util/Map;)Lreactor/core/publisher/Mono;

JVMVulnerable params: 1

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT