Description

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space.

Affected Spring Products and Versions

Spring Framework:

• 7.0.0 - 7.0.6
• 6.2.0 - 6.2.17
• 6.1.0 - 6.1.26
• 5.3.0 - 5.3.47
• Older, unsupported versions are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

This vulnerability was discovered and reported independently by Xint Code and Yuki Matsuhashi.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H&version=3.1

History

• 2026-04-17: Initial vulnerability report published.